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(54) Data delivery system with copyright protection 

(57) A data delivery system has a capability of ef- 
fectively and reliably protecting copyright of the data. A 
video source of a movie or the like is delivered in the 
• form of encrypted data from a server apparatus (1 ,2) to 
a playback apparatus (3). A decryption key used to de- 
crypt the encrypted data is stored on a storage medium 
such as a memory card (4), and the storage medium is 
sent from the server apparatus (1) to the playback ap- 
paratus (3) in parallel with the delivery of the encrypted 
data. After completion of the playing of the movie by the 
playback apparatus (3) in a movie theater (502), the R 
storage medium (4) is returned to the server apparatus 
(1). The server apparatus (1) examines information 
stored on the storage medium (4) to check whether the 
video source delivered in the form of data has been 
properly used in an authorized manner. 
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Description 

[0001] The present invention relates to data delivery. 
An illustrative embodiment of the present invention re- 
lates to a data delivery system suitable for use, for ex- 5 
ample, by a movie distribution company to deliver movie 
data to a movie theatre via a relay server. 
[0002] In recent years, a practical technique has been 
developed for transmitting a video source (video content 
data), for example, on a video-on-demand basis. This 10 
makes it possible to supply various types of video sourc- 
es without haying to use a film or a video cassette tape. 
[0003] A conventional movie distribution system is de- 
scribed below with reference to Fig. 56. 
[0004] Usually, a movie produced by a movie produc- 15 
tion company 500 is distributed, via movie distribution 
companies 501 a, 501b, 501c, and so on, to movie theat- 
ers 502a, 502b, 502c, 502d, and so on under contract. 
[0005] After shooting a movie, a movie producer edits 
a negative master film by cutting and connecting the 20 
film. After completion of the editing, an edited positive 
film is produced from the edited negative master film. 
The movie production company 500 produces a nega- 
tive master film from which films to be distributed will be 
produced. 25 
[0006] From this edited negative master film, a de- 
sired number of edited positive films are produced and 
delivered (transported) to movie distribution companies 
501a, 501b, and so on. 

[0007] Each of movie distribution companies 501a, 30 
501b, and so on produces a large number of negative 
films from a delivered positive film. The produced neg- 
ative films are delivered (transported) from the movie 
distribution companies 501a, 501b, and so on to movie 
theaters 502a, 502b, and so on in accordance with a 35 
contract. The movie theaters 502a, 502b, and so on 
show the movie using distributed films. 
[0008] If the playing period predetermined in accord- 
ance with the contract between the respective movie 
theaters 502a, 502b, and so on and a movie production 40 
company 500 or a movie distribution company 501 has 
expired, the negative films are returned to the movie dis- 
tribution company 501a from movie theaters 502a, 
502b,.., and so on. 

[0009] The movie distribution companies 502a, 502b, *s 
and so on dispose the negative films returned from the 
movie theaters thereby preventing the films from being 
used in an unauthorized manner. 

[0010] Alternatively, the movie production company 
500 collects all movie films from the movie distribution so 
companies 502a, 502b, and so on to prevent unauthor- 
ized use of the films. 

[001 1 ] In the conventional movie distribution system, 
distribution of a large number of films among movie pro- 
duction companies 500, movie distribution companies 55 
501 , and movie theaters 502 and production of a large 
number of films to be supplied to movie theaters 502 
need very high cost and very long time. 
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[0012] In view of the advance in the technology of data 
delivery system, it will be advantageous to deliver a 
movie not via a film but via electronic data. This can re- 
duce the delivery cost and the delivery time. 
[0013] However, to realize a movie distribution sys- 
tem by means of electronic data, the following problems 
should be resolved. 

[0014] It is required to protect the copyright of movie 
content data. To meet this requirement, it is needed to 
surely prevent distributed content data from being cop- 
ied in an unauthorized manner. In particular, this require- 
ment becomes very important when a video source is 
transmitted in the form of electronic data which can be 
more easily copied than a film. 

[0015] For example, there is a possibility that content 
data is stolen from a middle of a transmission line via 
which the content data is transmitted. 
[0016] Unlike movie films, content data is not corpo- 
real. This can cause content data to be easily copied at 
a movie theater site without permission. This means that 
it is impossible to completely prevent an unauthorized 
copy of content data by means of withdrawing, unlike 
films. 

[0017] A possible technique of preventing distributed 
video contents from being copied without permission is 
to encrypt video content data. However, in this case, it 
is required to transmit key data used by movie distribu- 
tion companies 501 or movie theaters 502 to decryptthe 
encrypted video content data. When a decryption key 
data is transmitted in a similar manner to content data, 
if the key data is hacked together with the video content 
data during transmission process, an unauthorized copy 
can be made. 

[0018] Embodiments of the present invention seek to 
provide a system in which movies can be distributed by 
means of transmission of electronic data without danger 
of being copied in an unauthorised manner, and distrib- 
uted video sources can be properly managed. 
[0019] Other embodiments of the present invention 
seek to provide a server apparatus, a reproducing ap- 
paratus, and an information storage medium suitable for 
use in such a system. 

[0020] Other embodiments of the present invention 
seek to provide a program storage medium including a 
processing program stored thereon for controlling the 
server apparatus or the reproducing apparatus. 
[0021] Other embodiments of the present invention 
seek to provide a control signal for controlling the server 
apparatus or the reproducing apparatus. According to 
an aspect of the present invention, there is provided a 
data delivery system comprising: encrypting means for 
encrypting data and outputting the resultant encrypted 
data; transmitting means for transmitting the encrypted 
data; recording means for recording, on a storage me- 
dium, a key used to decrypt the encrypted data; receiv- 
ing means for receiving the encrypted data transmitted 
by the transmitting means; reading means for reading 
the key stored on the storage medium; decrypting 
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means tor decrypting the encrypted data received by the 
receiving means, using the key read by the reading 
means; reproducing means for reproducing the data de- 
crypted by the decrypting means; control means forcon- 
trolling the reproduction of the data performed by the 
reproducing means in accordance with information 
stored on the storage medium; and judgment means for 
detecting unauthorized use of the data, on the basis of 
information stored on the storage medium. 
[0022] In this data delivery system, preferably, the re- 
cording means records an allowed reproduction period 
during which data corresponding to the key stored on 
the storage medium is allowed to be reproduced, and 
the judgment means detects unauthorized use of the da- 
ta, on the basis of the allowed reproduction period re- 
corded on the storage medium. 

[0023] The data delivery system may further comprise 
settling means for performing settlement corresponding 
to data reproduced by the reproducing means; and set- 
tlement information recording means for recording set- 
tlement information on the storage medium in response 
to the settlement, wherein the judgment means detects 
unauthorized use of the data, on the basis of the settle- 
ment information stored on the storage medium. 
[0024] The data delivery system may further comprise 
storage means for storing the received encrypted data; 
and delete flag recording means for, when the encrypted 
data stored in the storage means is deleted, recording 
a delete flag on the storage medium, wherein the judg- 
ment means detects unauthorized use of the data by 
judging whether the delete flag is recorded on the stor- 
age medium. 

[0025] In the data delivery system, the recording 
means may record an allowed reproduction period dur- 
ing which data corresponding to the key stored on the 
storage medium is allowed to be reproduced, and the 
control means may enable or disable the reproducing 
means to reproduce the data, in accordance with the 
allowed reproduction period recorded on the storage 
means. 

[0026], In the data delivery system, the recording 
means may record a number-of-times value indicating 
the number of times data corresponding to the key 
stored on the storage medium is allowed to be repro- 
duced, and the control means may enable or disable the 
reproducing means to reproduce the data in accordance 
with the number-of-times value recorded on the storage 
medium. 

[0027] The data delivery system may further comprise 
embedding means for embedding an electronic water- 
mark indicating the allowance of reproduction into the 
data, wherein the control means reduces the number- 
of-times value each time the reproducing means repro- 
duces the data' and the control means rewrites the elec- 
tronic watermark embedded in the data so as to indicate 
inhibition of reproduction when the number-of-times val- 
ue becomes equal to zero. 

[0028] The data delivery system may further comprise 
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transfer means capable of transferring the encrypted 
data received by the receiving means to another elec- 
tronic apparatus: detecting means for detecting a trans- 
fer operation performed by the transfer means; and ID 
5 recording means for, when the detecting means detects 
a transfer operation, recording an ID corresponding to 
the transfer means on the storage medium. 
[0029] The data delivery system may further comprise 
a mounting part for mounting the storage medium there- 
Jo in: memory means on which information recorded on the 
storage medium is stored when the storage medium is 
mounted in the mounting part; and rewriting means for 
rewriting the information recorded on the storage medi- 
um, wherein the control means controls the reproduc- 
es tion of the data performed by the reproducing means in 
accordance with the information stored in the memory 
means. 

[0030] The data delivery system may f u rther comprise 
rewriting means capable of rewriting the allowed repro- 
duction period during which the data corresponding to 
the key stored on the storage medium is allowed to be 
reproduced, so as to extend the allowed reproduction 
period. 

[0031] The data delivery system may further comprise 
updating means for updating the information recorded 
on the storage medium if the judgment means deter- 
mines, from the information recorded on the storage me- 
dium, that the use of the data is valid. 
[0032] Herein, the recording means may record, on 
the storage medium, an identifier of the data, an allowed 
reproduction period assigned to the data, and a key 
used to decrypt the data, and the updating means may 
update the information recorded on the storage medi- 
um, if the judgment means determines, from the infor- 
mation recorded on the storage medium, that the use of 
the data is valid. 

[0033] The data delivery system may fu rther comprise 
settling means for performing settlement in accordance 
with the number-of-times value recorded on the storage 
medium by the recording means, the number-of-times 
value indicating the number of times the data is allowed 
to be reproduced. 

[0034] Thedata delivery system may further comprise 
counter means for counting the number of times the data 
is reproduced by the reproducing means; and settle- 
ment means for performing settlement in accordance 
with a count value output by the counter means. 
[0035] The data delivery system may fu rther comprise 
payment amount recording means for recording pay- 
ment amount information on the storage medium in re- 
sponse to paying a fee; and payment amount updating 
means for updating the payment amount information re- 
corded on the storage medium in such a manner as to 
reduce the payment amount in accordance with the in- 
formation recorded on the storage medium by the re- 
cording means. 

[0036] According to another aspect of the present in- 
vention, there is provided a server apparatus for deliv- 
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ering data to a reproducing apparatus, comprising: en- 
crypting means for encrypting data and outputting the 
resultant encrypted data; transmitting means for trans- 
mitting the encrypted data to the reproducing apparatus; 
recording means for recording, on a storage medium, a 
key used to decrypt the encrypted data; and judgment 
means for detecting unauthorized use of the data trans- 
mitted from the transmitting means, on the basis of in- 
formation stored on the storage medium returned from 
the reproduction apparatus. 

[0037] Inthisserverapparatus, preferably, the record- 
ing means records an allowed reproduction period dur- 
ing which data corresponding to the key stored on the 
storage medium is allowed to be reproduced. 
[0038] In this server apparatus, preferably, the judg- 
ment means detects unauthorized use of the data, on 
the basis of the allowed reproduction period recorded 
on the storage medium. 

[0039] The judgment means may detect unauthorized 
use of the data, on the basis of the settlement informa- 
tion recorded on the storage medium by the reproducing 
apparatus. 

[0040] The judgment means may detect unauthorized 
use of the data by judging whether a delete flag, which 
indicates that the data transmitted from the transmitting 
means has been deleted, is recorded on a storage me- 
dium returned from the reproducing apparatus. 
[0041] The recording means may record a number- 
of -times value indicating the number of times data cor- 
responding to the key stored on the storage medium is 
allowed to be reproduced. 

[0042] The server apparatus may further comprise 
embedding means for embedding an electronic water- 
mark indicating the allowance of reproduction into the 
data. 

[0043] Herein, the judgment means may detect unau- 
thorized use of the data by judging whether information 
indicating that the data transmitted from the transmitting 
means has been transferred is recorded on a storage 
medium returned from the reproducing apparatus. 
[0044] The server apparatus may further comprise re- 
writing means capable of rewriting the allowed repro- 
duction period during which the data corresponding to 
the key stored on the storage medium is allowed to be 
reproduced, so as to extend the allowed reproduction 
period. 

[0045] The server apparatus may further comprise 
updating means for updating the information recorded 
on the storage medium if the judgment means deter- 
mines, from the information recorded on the storage me- 
dium, that the use of the data is valid. 
[0046] Herein, the recording means may record, on 
the storage medium, an identifier of the data, an allowed 
reproduction period assigned to the data, and a key 
used to decrypt the data, and the updating means may 
update the information recorded on the storage medi- 
um, if the judgment means determines, from the infor- 
mation recorded on the storage medium, that the use of 



the data is valid. 

[0047] The server apparatus may further comprise, 
payment amount updating means for, when payment 
amount information is recorded on the storage medium 

5 in response to payment of a fee performed by the repro- 
ducing apparatus, updating the payment amount infor- 
mation recorded on the storage medium in such a man- 
ner as to reduce the payment amount in accordance 
with the information recorded on the storage medium by 

10 the recording means. 

[0048] According to still another aspect of the present 
invention, there is provided a reproducing apparatus to 
which encrypted data is transmitted from a predeter- 
mined server apparatus and to which a storage medium 

15 including a key stored thereon for use in decrypting the 
encrypted data is sent, the reproducing apparatus com- 
prising: receiving means for receiving the encrypted da- 
ta transmitted from the predetermined server apparatus; 
reading means for reading the key stored on the storage 

20 medium; decrypting means for decrypting the encrypted 
data received by the receiving means, using the key 
read by the reading means; reproducing means for re- 
producing the data decrypted by the decrypting means; 
and control means for controlling the reproduction of the 

25 data performed by the reproducing means in accord- 
ance with information stored on the storage medium. 
[0049] In this reproducing apparatus, preferably, the 
recording means records an allowed reproduction peri- 
od during which data corresponding to the key stored 

30 on the storage medium is allowed to be reproduced, and 
the control means enables or disables the reproducing 
means to reproduce the data, in accordance with the 
allowed reproduction period recorded on the storage 
means. 

35 [0050] The reproducing apparatus may further com- 
prise settling means for performing settlement corre- 
sponding to data reproduced by the reproducing means; 
and settlement information recording means for record- 
ing settlement information on the storage medium in re- 

40 sponse to the settlement. 

[0051] The reproducing apparatus may further com- 
prise storage means for storing the received encrypted 
data; and delete flag recording means for, when the en- 
crypted data stored in the storage means is deleted, re- 

45 cording a delete flag on the storage medium. 

[0052] Herein, a number-of -times value, indicating 
the number of times data corresponding to the key 
stored on the storage medium is allowed to be repro- 
duced, may be stored on the storage medium, and the 

50 control means may enable or disable the reproducing 
means to reproduce the data in accordance with the 
number-of-times value recorded on the storage medi- 
um. 

[0053] The data received by the receiving means may 
55 include an electronic watermark embedded in the data, 
the watermark indicating that the data is permitted to be 
reproduced, and the control means may reduce the 
number-of-times value each time the reproducing 
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means reproduces the data, and the control means re- 
writes the electronic watermark embedded in the data 
so as to indicate inhibition of reproduction when the 
number-of-times value becomes equal to zero. 
[0054] The reproducing apparatus may further com- 
prise transfer means capable of transferring the encrypt- 
ed data received by the receiving means to another 
electronic apparatus; detecting means for detecting a 
transfer operation performed by the transfer means; and 
ID recording means for, when the detecting means de- 
tects a transfer operation, recording an ID correspond- 
ing to the transfer means on the storage medium. 
[0055] The reproducing apparatus may further com- 
prise a mounting part for mounting the storage medium 
therein: memory means on which information recorded 
on the storage medium is stored when the storage me- 
dium is mounted in the mounting part; and rewriting 
means for rewriting the information recorded on the stor- 
age medium, wherein the control means controls the re- 
production of the data performed by the reproducing 
means in accordance with the information stored in the 
memory means. 

[0056] The reproducing apparatus may further com- 
prise rewriting means capable of rewriting the allowed 
reproduction period during which the data correspond- 
ing to the key stored on the storage medium is allowed 
to be reproduced, so as to extend the allowed reproduc- 
tion period. 

[0057] The reproducing apparatus may further com- 
prising settling means for performing settlement in ac- 
cordance with the number-of-times value recorded on 
the storage medium, the number-of-times value indicat- 
ing the number of times the data is allowed to be repro- 
duced. 

[0058] The reproducing apparatus may further com- 
prise counter means for counting the number of times 
the data is reproduced by the reproducing means; and 
settlement means for performing settlement in accord- 
ance with a count value output by the counter means. 
[0059] The reproducing apparatus may further com- 
prise payment amount recording means for recording 
payment amount information on the storage medium in 
response to paying a fee. 

[0060] According to still another aspect of the present 
invention, there is provided a data delivery method com- 
prising: an encrypting step for encrypting data and out- 
pulling the resultant encrypted data; a transmitting step 
for transmitting the encrypted data; a recording step for 
recording, on a storage medium, a key used to decrypt 
the encrypted data; a receiving step for receiving the en- 
crypted data transmitted in the transmitting step; a read- 
ing step for reading the key stored on the storage me- 
dium; a decrypting step for decrypting the encrypted da- 
ta received in the receiving step, using the key read in 
the reading step; a reproducing step for reproducing the 
data decrypted in the decrypting step; a control step for 
controlling the reproduction of the data performed in the 
reproducing step, in accordance with information stored 
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on the storage medium; and a judgment step for detect- 
ing unauthorized use of the data, on the basis of infor- 
mation stored on the storage medium. 
[0061] In this data delivery method, preferably, the re- 
5 cording step records an allowed reproduction period 
during which data corresponding to the key stored on 
the storage medium is allowed to be reproduced, and 
the judgment step detects unauthorized use of the data, 
on the basis of the allowed reproduction period recorded 

10 on the storage medium. 

[0062] The data delivery method may further com- 
prise a settling step for performing settlement corre- 
sponding to data reproduced in the reproducing step; 
and a settlement information recording step for record- 

15 ing settlement information on the storage medium in re- 
sponse to the settlement, wherein the judgment step de- 
tects unauthorized use of the data, on the basis of the 
settlement information stored on the storage medium. 
[0063] The data delivery method may further com- 

20 prise a storing step for storing the received encrypted 
data in storage means; and a delete flag recording step 
for, when the encrypted data stored in the storage 
means is deleted, recording a delete flag on the storage 
medium, wherein the judgment step detects unauthor- 

25 ized use of the data by judging whether the delete flag 
is recorded on the storage medium. 
[0064] In this data delivery method, the recordingstep 
may record an allowed reproduction period during which 
data corresponding to the key stored on the storage me- 

30 dium is allowed to be reproduced, and the control step 
may enable or disable the reproduction of the data in 
the reproducing step, in accordance with the allowed re- 
production period recorded on the storage medium. 
[0065] The recording step may record a number-of- 

35 times value indicating the number of times data corre- 
sponding to the key stored on the storage medium is 
allowed to be reproduced, and the control means may 
enable or disable the reproduction of the data in the re- 
producing step in accordance with the number-of-times 

40 value recorded on the storage medium. 

[0066] The data delivery method may further com- 
prise an embedding step for embedding an electronic 
watermark indicating the allowance of reproduction into 
the data, wherein the control step reduces the number- 

4 5 of-times value each time the reproducing step reproduc- 
es the data, and the control step rewrites the electronic 
watermark embedded in the data so as to indicate inhi- 
bition of reproduction when the number-of-times value 
becomes equal to zero. 

so [0067] The data delivery method may further com- 
prise a transfer step in which the encrypted data re- 
ceived in the receiving step may be transferred by trans- 
fer means to another electronic apparatus; a detecting 
step for detecting transferring, in the transfer step, of the 

55 encrypted data received in the receiving step to another 
electronic apparatus; and an ID recording step for, when 
the detecting step detects transferring of the encrypted 
data, recording an ID corresponding to the transfer 
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means on the storage medium. 

[0068] The data delivery method may further com- 
prise a mounting step for mounting the storage medium 
into a mounting part; a memorizing step for storing, into 
memory means, information recorded on the storage 
medium when the storage medium is mounted in the 
mounting part; and a rewriting step for rewriting the in- 
formation recorded on the storage medium, wherein the 
control step controls the reproduction of the data per- 
formed in the reproducing step in accordance with the 
information stored in the memory means. 
[0069] The data delivery method may further com- 
prise a rewriting step in which the allowed reproduction 
period, during which the data corresponding to the key 
stored on the storage medium is allowed to be repro- 
duced, may be rewritten so as to extend the allowed re- 
production period. 

[0070] The data delivery method may further com- 
prise an updating step for updating the information re- 
corded on the storage medium if the judgment step de- 
termines, from the information recorded on the storage 
medium, that the use of the data is valid. 
[0071] Herein, the recording step may record, on the 
storage medium, an identifier of the data, an allowed re- 
production period assigned to the data, and a key used 
to decrypt the data, and the updating step may update 
the information recorded on the storage medium, if the 
judgment step determines, from the information record- 
ed on the storage medium, that the use of the data is 
valid. 

[0072] The data delivery method may further com- 
prise a settling step for performing settlement in accord- 
ance with the number-of-times value recorded on the 
storage medium in the recording step, the number-of- 
times value indicating the number of times the data is 
allowed to be reproduced. 

[0073] The data delivery method may further com- 
prise a counting step for counting the number of times 
the data is reproduced in the reproducing step; and a 
settlement step for performing settlement in accordance 
with a count value counted in the counting step. 
[0074] The data delivery method may further com- 
prise a payment amount recording step for recording 
payment amount information on the storage medium in 
response to paying a fee; and a payment amount up- 
dating step for updating the payment amount inforrna- 
tion recorded on the storage medium in such a manner 
as to reduce the payment amount in accordance with 
the information recorded on the storage medium in the 
recording step. 

[0075] According to still another aspect of the present 
invention, there is provided a method of controlling a 
server apparatus so as to deliver data from the server 
apparatus to a reproducing apparatus, comprising: an 
encrypting step for encrypting data and outputting the 
resultant encrypted data; a transmitting step for trans- 
mitting the encrypted data to the reproducing apparatus; 
a recording step for recording, on a storage medium, a 



key used to decrypt the encrypted data; and a judgment 
step for detecting unauthorized use of the data transmit- 
ted in the transmitting step, on the basis of information 
stored on the storage medium returned from the repro- 

5 duction apparatus. 

[0076] In this method of controlling the server appa- 
ratus, preferably, the recording step records an allowed 
reproduction period during which data corresponding to 
the key stored on the storage medium is allowed to be 

10 reproduced. 

[0077] In the method of controlling the server appara- 
tus, preferably, the judgment step detects unauthorized 
use of the data, on the basis of the allowed reproduction 
period recorded on the storage medium. 

15 [0078] In this method of controlling the server appa- 
ratus, the judgment step may detect unauthorized use 
of the data, on the basis of the settlement information 
recorded on the storage medium by the reproducing ap- 
paratus. 

20 [0079] The judgment step may detect unauthorized 
use of the data by judging whether a delete flag, which 
indicates that the data transmitted in the transmitting 
step has been deleted, is recorded on a storage medium 
returned from the reproducing apparatus. 

25 [0080] The recording step may record a number-of- 
times value indicating the number of times data corre- 
sponding to the key stored on the storage medium is 
allowed to be reproduced. 

[0081 ] The method of contrail ing the server apparatus 
w may further comprise an embedding step for embedding 
an electronic watermark indicating the allowance of re- 
production into the data. 

[0082] Herein, the judgment step may detect unau- 
thorized use of the data by judging whether information 

« indicating that the data transmitted in the transmitting 
step has been transferred is recorded on a storage me- 
dium returned from the reproducing apparatus. 
[0083] The method of controlling the server apparatus 
may further comprise a rewriting step in which the al- 

o lowed reproduction period, during which the data corre- 
sponding to the key stored on the storage medium is 
allowed to be reproduced, may be rewritten so as to ex- 
tend the allowed reproduction period. 
[0084] The method of controlling the server apparatus 

5 may further comprise an updating step for updating the 
information recorded on the storage medium if the judg- 
ment step determines, from the information recorded on 
the storage medium, that the use of the data is valid. 
[0085] Herein, the recording step may record, on the 

o storage medium, an identifier of the data, an allowed re- 
production period assigned to the data, and a key used 
to decrypt the data, and the updating step may update 
the information recorded on the storage medium, if the 
judgment step determines, from the information record- 

5 ed on the storage medium, that the use of the data is 
valid. 

[0086] The method of controlling the server apparatus 
may further comprise a payment amount updating step 
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for, when payment amount information is recorded on 
the storage medi urn in response to payment of a fee per- 
formed by the reproducing apparatus, updating the pay- 
ment amount information recorded on the storage me- 
dium in such a manner as to reduce the payment 
amount in accordance with the information recorded on 
the storage medium in the recording step. 
[0087] According to still another aspect of the present 
invention, there is provided a method of controlling a re- 
producing apparatus to which encrypted data is trans- 
mitted from a predetermined server apparatus and to 
which a storage medium including a key stored thereon 
for use in decrypting the encrypted data is sent, the 
method comprising: a receiving step for receiving the 
encrypted data transmitted from the predetermined 
server apparatus; a reading step for reading the key 
stored on the storage medium; a decrypting step for de- 
crypting the encrypted data received in the receiving 
step, using the key read in the reading step; a reproduc- 
ing step for reproducing the data decrypted in the de- 
crypting step; and a control step for controlling the re- 
production of the data performed in the reproducing step 
in accordance with information stored on the storage 
medium. 

[0088] In this method of controlling the reproducing 
apparatus, preferably the recording step records an al- 
lowed reproduction period during which data corre- 
sponding to the key stored on the storage medium is 
allowed to be reproduced, and the control step enables 
or disables the reproduction of the data in the reproduc- 
ing step, in accordance with the allowed reproduction 
period recorded on the storage means. 
[0089] The method of controlling the reproducing ap- 
paratus may f urthercomprise a settling step for perform- 
ing settlement corresponding to data reproduced in the 
reproducing step; and a settlement information record- 
ing step for recording settlement information on the stor- 
age medium in response to the settlement. 
[0090] The method of controlling the reproducing ap- 
paratus may further comprise a storing step for storing 
the received encrypted data into storage means; and a 
delete flag recording step for, when the encrypted data 
stored in the storage means is deleted, recording a de- 
lete flag on the storage medium. 

[0091] Herein, a number-of-times value, indicating 
the number of times data corresponding to the key 
stored on the storage medium is allowed to be repro- 
duced, may be stored on the storage medium, and the 
control step may enable or disable the reproduction of 
the data in the reproducing step, in accordance with the 
number-of-times value recorded on the storage medi- 
um. 

[0092] The data received in the receiving step may in- 
clude an electronic watermark embedded in the data, 
the watermark indicating that the data is permitted to be 
reproduced, and the control step may reduce the 
number-of-times value each time the reproducing step 
reproduces the data, and the control step may rewrite 



the electronic watermark embedded in the data so as to 
indicate inhibition of reproduction when the number-of- 
times value becomes equal to zero. 
[0093] The method of controlling the reproducing ap- 

5 paratus may further comprise a transfer step in which 
the encrypted data received in the receiving step may 
be transferred by transfer means to another electronic 
apparatus; a detecting step for detecting transferring, in 
the transfer step, of the encrypted data received in the 

io receiving step to another electronic apparatus; and an 
ID recording step for, when the detecting step detects 
transferring of the encrypted data, recording an ID cor- 
responding to the transfer means on the storage medi- 
um. 

15 [0094] The method of controlling the reproducing ap- 
paratus may further comprise a mounting step for 
mounting the storage medium into a mounting part; a 
memorizing step for storing, into memory means, infor- 
mation recorded on the storage medium when the stor- 
20 age medium is mounted in the mounting part; and a re- 
writing step for rewriting the information recorded on the 
storage medium, wherein the control step controls the 
reproduction of the data performed in the reproducing 
step in accordance with the information stored in the 
memory means. 

[0095] The method of controlling the reproducing ap- 
paratus may further comprise a rewriting step in which 
the allowed reproduction period, during which the data 
corresponding to the key stored on the storage medium 
is allowed to be reproduced, may be rewritten so as to 
extend the allowed reproduction period. 
[0096] The method of controlling the reproducing ap- 
paratus may further comprise a settling step for perform- 
ing settlement in accordance with the number-of-times 
value recorded on the storage medium, the number-of- 
times value indicating the number of times the data is 
allowed to be reproduced. 

[0097] The method of controlling the reproducing ap- 
paratus may further comprise a counting step for count- 
ing the number of times the data is reproduced in the 
reproducing step; and a settlement step for performing 
settlement in accordance with a count value counted in 
the counting step. 

[0098] The method of controlling the reproducing ap- 
paratus may further comprise a payment amount re- 
cording step for recording payment amount information 
on the storage medium in response to paying a fee. 
[0099] According to still another aspect of the present 
invention, there is provided a program storage medium 
including a processing program, stored thereon, forcon- 
trolling a server apparatus to perform a process of de- 
livering data from the server apparatus to a reproducing 
apparatus, the process comprising: an encrypting step 
for encrypting data and outputting the resultant encrypt- 
ed data; a transmitting step for transmitting the encrypt- 
ed data to the reproducing apparatus; a recording step 
for recording, on an information storage medium, a key 
used to decrypt the encrypted data; and a judgment step 
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for detecting unauthorized use of the data transmitted 
in the transmitting step, on the basis of information 
stored on the information storage medium returned from 
the reproduction apparatus. 

[0100] In this program storage medium, preferably, 
the recording step records an allowed reproduction pe- 
riod during which data corresponding to the key stored 
on the information storage medium is allowed to be re- 
produced. 

[0101] In this program storage medium, preferably, 
the judgment step detects unauthorized use of the data, 
on the basis of the allowed reproduction period recorded 
on the information, storage medium. 
[0102] The judgment step may detect unauthorized 
use of the data, on the basis of the settlement informa- 
tion recorded on the information storage medium by the 
reproducing apparatus. 

[0103] The judgment step may detect unauthorized 
use of the data by judging whether a delete flag, which 
indicates that the data transmitted in the transmitting 
step has been deleted, is recorded on an information 
storage medium returned from the reproducing appara- 
tus. 

[0104] The recording step may record a number-of- 
times value indicating the number of times data corre- 
sponding to the key stored on the information storage 
medium is allowed to be reproduced. 
[0105] In the program storage medium, the process 
may furthercomprise an embedding step for embedding 
an electronic watermark indicating the allowance of re- 
production into the data. 

[0106] The judgment step may detect unauthorized 
use of the databy judging whether information indicating 
that the data transmitted in the transmitting step has 
been transferred is recorded on an information storage 
medium returned from the reproducing apparatus. 
[0107] In the program storage medium ; the process 
may further comprise a rewriting step in which the al- 
lowed reproduction period, during which the data corre- 
sponding to the key stored on the storage medium is 
allowed to be reproduced, may be rewritten so as to ex- 
tend the allowed reproduction period. 
[0108] In the program storage medium, the process 
may further comprise an updating step for updating the 
information recorded on the storage medium if the judg- 
ment step determines, from the information recorded on 
the storage medium, that the use of the data is valid. 
[0109] The recording step may record, on the infor- 
mation storage medium, an identifier of the data, an al- 
lowed reproduction period assigned to the data, and a 
key used to decrypt the data, and the updating step may 
update the information recorded on the information stor- 
age medium, if the judgment step determines, from the 
information recorded on the information storage medi- 
um, that the use of the data is valid. 
[0110] In the program storage medium, the process 
may further comprise a payment amount updating step 
for, when payment amount information is recorded on 



the information storage medium in response to payment 
of a fee performed by the reproducing apparatus, up- 
dating the payment amount information recorded on the 
information storage medium in such a manner as to re- 
5 duce the payment amount in accordance with the infor- 
mation recorded on the information storage medium in 
the recording step. 

[0111] According to still another aspect of the present 
invention, there is provided a program storage medium 
10 including a processing program, storedthereon, forcon- 
trolling a reproducing apparatus, to which encrypted da- 
ta is transmitted from a predetermined server apparatus 
and to which an information storage medium including 
a key stored thereon for use in decrypting the encrypted 
15 data is sent, so as to perform a process comprising a 
receiving step for receiving the encrypted data transmit- 
ted from the predetermined server apparatus; a reading 
step for reading the key stored on the information stor- 
age medium; a decrypting step for decrypting the en- 
20 crypted data received in the receiving step, using the 
key read in the reading step; a reproducing step for re- 
producing the data decrypted in the decrypting step; and 
a control step for controlling the reproduction of the data 
performed in the reproducing step in accordance with 
25 information stored on the information storage medium. 
[0112] Preferably the recording step records an al- 
lowed reproduction period during which data corre- 
sponding to the key stored on the information storage 
medium is allowed to be reproduced, and the control 
30 step enables or disables the reproduction of the data in 
the reproducing step, in accordance with the allowed re- 
production period recorded on the information storage 
means. 

[0113] In the program storage medium, the process 
35 may further comprise a settling step for performing set- 
tlement corresponding to data reproduced in the repro- 
ducing step, and a settlement information recording step 
for recording settlement information on the information 
storage medium in response to the settlement. 
40 [0114] In the program storage medium, the process 
may further comprise a storing step for storing the re- 
ceived encrypted data into storage means; and a delete 
flag recording step for, when the encrypted data stored 
in the storage means is deleted, recording a delete flag 
45 on the information storage medium. 

[01 15] A program storage medium according to Claim 
91 , wherein the process further comprises a number-of- 
times value, indicating the number of times data corre- 
sponding to the key stored on the information storage 
50 medium is allowed to be reproduced, is stored on the 
information storage medium; and the control step ena- 
bles or disables the reproduction of the data in the re- 
producing step, in accordance with the number-of-times 
value recorded on the information storage medium. 
55 [0116] Herein, data received in the receiving step may 
include an electronic watermark embedded in the data, 
the watermark indicating that the data is permitted to be 
reproduced, and the control step may reduce the 
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nurnber-of -times value each time the reproducing step 
reproduces the data, and the control step may rewrite 
the electronic watermark embedded in the data so as to 
indicate inhibition of reproduction when the number-of- 
times value becomes equal to zero. 
[0117] In the program storage medium, the process 
may further comprise a transfer step in which the en- 
crypted data received in the receiving step may be trans- 
ferred by transfer means to another electronic appara- 
tus; a detecting step for detecting transferring, in the 
transfer step, of the encrypted data received in the re- 
ceiving step to another electronic apparatus; and an ID 
recording step for, when the detecting step detects 
transferring of the encrypted data, recording an ID cor- 
responding to the transfer means on the information 
storage medium. 

[0118] In the program storage medium, the process 
may further comprise a mounting step for mounting the 
information storage medium into a mounting part; a 
memorizing step for storing, into memory means, infor- 
mation recorded on the information storage medium 
when the information storage medium is mounted in the 
mounting part; and a rewriting step for rewriting the in- 
formation recorded on the information storage medium, 
wherein the control step controls the reproduction of the 
data performed in the reproducing step in accordance 
with the information stored in the memory means. 
[0119] In the program storage medium, the process 
may further comprise a rewriting step in which the al- 
lowed reproduction period, during which the data corre- 
sponding to the key stored on the information storage 
medium is allowed to be reproduced, may be rewritten 
so as to extend the allowed reproduction period. 
[0120] In the program storage medium, the process 
may further comprise a settling step for performing set- 
tlement in accordance with the number-of-times value 
recorded on the information storage medium, the 
number-of-times value indicating the number of times 
the data is allowed to be reproduced. 
[0121] In the program storage medium, the process 
may further comprise a counting step for counting the 
number of times the data is reproduced in the reproduc- 
ing step; and a settlement step for performing settlement 
in accordance with a count value counted in the counting 
step. 

[0122] In the program storage medium, the process 
may further comprise a payment amount recording step 
for recording payment amount information on the infor- 
mation storage medium in response to paying a fee. 
[0123] According to still another aspect of the present 
invention, there is provided a control signal for control- 
ling a server apparatus to perform a process of deliver- 
ing data from the server apparatus to a reproducing ap- 
paratus, the process comprising: an encrypting step for 
encrypting data and outputting the resultant encrypted 
data; a transmitting step for transmitting the encrypted 
data to the reproducing apparatus; a recording step for 
recording, on an information storage medium, a key 



used to decrypt the encrypted data; and a judgment step 
for detecting unauthorized use of the data transmitted 
in the transmitting step, on the basis of information 
stored on the information storage medium returned from 

5 the reproduction apparatus. 

[0124] Preferably, the recording step records an al- 
lowed reproduction period during which data corre- 
sponding to the key stored on the information storage 
medium is allowed to be reproduced. 

10 [0125] Preferably, the judgment step detects unau- 
thorized use of the data, on the basis of the allowed re- 
production period recorded on the information storage 
medium. 

[0126] The judgment step may detect unauthorized 
15 use of the data, on the basis of the settlement informa- 
tion recorded on the information storage medium by the 
reproducing apparatus. 

[0127] The judgment step may detect unauthorized 
use of the data by judging whether a delete flag, which 
20 indicates that the data transmitted in the transmitting 
step has been deleted, is recorded on an information 
storage medium returned from the reproducing appara- 
tus. 

[0128] The recording step may record a number-of- 
25 times value indicating the number of times data corre- 
sponding to the key stored on the information storage 
medium is allowed to be reproduced. 
[0129] In this control signal, the process may further 
comprise an embedding step for embedding an elec- 
30 tronic watermark indicating the allowance of reproduc- 
tion into the data. 

[0130] Herein, the judgment step may detect unau- 
thorized use of the data by judging whether information 
indicating that the data transmitted in the transmitting 
35 step has been transferred is recorded on an information 
storage medium returned from the reproducing appara- 
tus. 

[0131] In the control signal, the process may further 
comprise a rewriting step in which the allowed reproduc- 
^0 tion period, during which the data corresponding to the 
key stored on the storage medium is allowed to be re- 
produced, may be rewritten so as to extend the allowed 
reproduction period. 

[0132] In the control signal, the process may further 
^5 comprise an updating step for updating the information 
recorded on the storage medium if the judgment step 
determines, from the information recorded on the stor- 
age medium, that the use of the data is valid. 
[0133] Herein, the recording step may record, on the 
50 information storage medium, an identifier of the data, an 
allowed reproduction period assigned to the data, and 
a key used to decrypt the data, and the updating step 
updates the information recorded on the information 
storage medium, if the judgment step determines, from 
55 the information recorded on the information storage me- 
dium, that the use of the data is valid. 
[0134] In the control signal, the process may further 
comprises a payment amount updating step for, when 
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payment amount information is recorded on the infor- 
mation storage medium in response to payment of a fee 
performed by the reproducing apparatus, updating the 
payment amount information recorded on the informa- 
tion storage medium in such a manner as to reduce the 
payment amount in accordance with the information re- 
corded on the information storage medium in the record- 
ing step. 

[0135] According to still another aspect of the present 
invention, there is provided a control signal for control- 
ling a reproducing apparatus, to which encrypted data 
is transmitted from a predetermined server apparatus 
and to which an information storage medium including 
a key stored thereon for use in decrypting the encrypted 
data is sent, so as to perform a process comprising a 
receiving step for receiving the encrypted data transmit- 
ted from the predetermined server apparatus; a reading 
step for reading the key stored on the information stor- 
age medium; a decrypting step for decrypting the en- 
crypted data received in the receiving step, using the 
key read in the reading step; a reproducing step for re- 
producing the data decrypted in the decrypting step; and 
a control step for controlling the reproduction of the data 
performed in the reproducing step in accordance with 
information stored on the information storage medium. 
[0136] Preferably, the recording step records an al- 
lowed reproduction period during which data corre- 
sponding to the key stored on the information storage 
medium is allowed to be reproduced, and the control 
step enables or disables the reproduction of the data in 
the reproducing step, in accordance with the allowed re- 
production period recorded on the information storage 
means. 

[0137] In this control signal, the process may further 
comprise a settling step for performing settlement cor- 
responding to data reproduced in the reproducing step; 
and a settlement information recording step for record- 
ing settlement information on the information storage 
medium in response to the settlement. 
[0138] In the control signal, the process may further 
comprise a storing step for storing the received encrypt- 
ed data into storage means; and a delete flag recording 
step for, when the encrypted data stored in the storage 
means is deleted, recording a delete flag on the infor- 
mation storage medium. 

[0139] In the control signal, the process may further 
comprise a number-of-times value, indicating the 
number of times data corresponding to the key stored 
on the information storage medium is allowed to be re- 
produced, is stored on the information storage medium; 
and the control step enables or disables the reproduc- 
tion of the data in the reproducing step, in accordance 
with the number-of-times value recorded on the infor- 
mation storage medium. 

[01 40] Herein, data received in the receiving step may 
include an electronic watermark embedded in the data, 
the watermark indicating that the data is permitted to be 
reproduced, and the control step may reduce the 



number-of-times value each time the reproducing step 
reproduces the data, and the control step may rewrite 
the electronic watermark embedded in the data so as to 
indicate inhibition of reproduction when the number-of- 

5 times value becomes equal to zero. 

[0141] In the control signal, the process may further 
comprise a transfer step in which the encrypted data re- 
ceived in the receiving step may be transferred by trans- 
fer means to another electronic apparatus; a detecting 

10 step for detecting transferring , in the transfer step, of the 
encrypted data received in the receiving step to another 
electronic apparatus; and an ID recording step for, when 
the detecting step detects transferring of the encrypted 
data, recording an ID corresponding to the transfer 

15 means on the information storage medium. 

[0142] In the control signal, the process may further 
comprise a mounting step for mounting the information 
storage medium into a mounting part; a memorizing step 
for storing, into memory means, information recorded 

20 on the information storage medium when the informa- 
tion storage medium is mounted in the mounting part; 
and a rewriting step for rewriting the information record- 
ed on the information storage medium, wherein the con- 
trol step controls the reproduction of the data performed 

25 jn the reproducing step in accordance with the informa- 
tion stored in the memory means. 
[0143] In the control signal, the process may further 
comprise a rewriting step in which the allowed reproduc- 
tion period, during which the data corresponding to the 

30 key stored on the information storage medium is allowed 
to be reproduced, may be rewritten so as to extend the 
allowed reproduction period. 

[0144] In the control signal, the process may further 
comprise a settling step for performing settlement in ac- 
35 cordance with the number-of-times value recorded on 
the information storage medium, the number-of-times 
value indicating the number of times the data is allowed 
to be reproduced. 

[0145] In the control signal, the process may further 
40 comprise a counting step for counting the number of 
times the data is reproduced in the reproducing step; 
and a settlement step for performing settlement in ac- 
cordance with a count value counted in the counting 
step. 

15 [0146] In the control signal, the process may further 
comprise a payment amount recording step for record- 
ing payment amount information on the information stor- 
age medium in response to paying a fee. 
[0147] According to still another aspect of the present 

50 invention , there is provided a data delivery method com- 
prising: an encrypting step for encrypting data and out- 
putting the resultant encrypted data; a transmitting step 
for transmitting the encrypted data; a recording step for 
recording, on a storage medium, a key used to decrypt 

55 the encrypted data; a receiving step for receiving the en- 
crypted data transmitted from the predetermined server 
apparatus; a reading step for reading the key stored on 
the storage medium; a decrypting step for decrypting the 
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encrypted data received in the receiving step : using the 
key read in the reading step; a controlling step for ena- 
bling or disabling reproduction of the data decrypted in 
the decrypting step, in accordance with the information 
recorded on the storage medium; a reproducing step for 5 
reproducing the decrypted data, in accordance with the 
control in the controlling step: and a judging step for de- 
tecting unauthorized use of the data, on the basis of in-" 
formation stored on the storage medium. 
[0148] According to still another aspect of the present 10 
invention, there is provided a method of delivering data 
to a reproducing apparatus, comprising: an encrypting 
step for encrypting data and outputting the resultant en- 
crypted data; a transmitting step for transmitting the en- 
crypted data; a recording step for recording, on a stor- 15 
age medium, a key used to decrypt the encrypted data; 
and a judging step for detecting unauthorized use of the 
data, on the basis of information stored on a storage me- 
dium returned from the reproducing apparatus. 
[0149] According to still another aspect of the present 20 
invention, there is provided a method of reproducing da- 
ta by a reproducing apparatus to which encrypted data 
is transmitted from a predetermined server apparatus 
and to which a storage medium including a key stored 
thereon for use in decrypting the encrypted data is sent, 25 
the method comprising: a receiving step for receiving 
the encrypted data transmitted from the predetermined 
server apparatus; a reading step for reading the key 
stored on the storage medium; a decrypting step for de- 
crypting the encrypted data received in the receiving 30 
step, using the key read in the reading step; a controlling 
step for enabling or disabling reproduction of the data 
decrypted in the decrypting step, in accordance with the 
information recorded on the storage medium; and a re- 
producing step for reproducing the decrypted data, in 35 
accordance with the control in the controlling step. 
[01 50] According to still another aspect of the present 
invention, there is provided a storage medium including 
a processing program, stored thereon, for controlling a 
server apparatus to execute a data delivery process for 40 
delivering data to a reproducing apparatus . the process- 
ing program comprising: an encrypting step for encrypt- 
ing data and outputting the resultant encrypted data; a 
transmitting step for transmitting the encrypted data; a 
recording step for recording, on a storage medium, a 45 
key used to decrypt the encrypted data; and a judging 
step for delecting unauthorized use of the data, on the 
basis of information stored on a storage medium re- 
turned from the reproducing apparatus. 
[01 51 ] According to still another aspect of the present so 
invention, there is provided a program storage medium 
including a processing program, stored thereon, for con- 
trolling a reproducing apparatus to which encrypted data 
is transmitted from a predetermined server apparatus 
and to which an information storage medium including 55 
a key stored thereon for use in decrypting the encrypted 
data is sent, the processing program serving to control 
the reproducing apparatus to perform a process of re- 



producing the data, the process comprising: a receiving 
step for receiving the encrypted data transmitted from 
the predetermined server apparatus; a reading step for 
reading the key stored on the information storage me- 
dium; a decrypting step for decrypting the encrypted da- 
ta received in the receiving step, using the key read in 
the reading step; a controlling step for enabling or dis- 
abling reproduction of the data decrypted in the decrypt- 
ing step, in accordance with the information recorded 
on the information storage medium; and a reproducing 
step for reproducing the decrypted data, in accordance 
with the control in the controlling step. 
[01 52] According to still another aspect of the present 
invention, there is provided a storage medium which is 
delivered between a server apparatus and a reproduc- 
ing apparatus in a data delivery system for delivering 
encrypted data from the server apparatus to the repro- 
ducing apparatus, wherein at least information indicat- 
ing an identifier of the data, a key used to decrypt the 
data, and a reproduction condition of the data is stored 
on the storage medium. 

[0153] In this storage medium, preferably, the infor- 
mation indicating the reproduction condition is informa- 
tion indicating a period during which the data is allowed 
to be reproduced. 

[0154] The information indicating the reproduction 
condition may be information indicating the number of 
times the data is allowed to be reproduced. 
[0155] Settlement information may be stored on the 
storage medium in response to settlement associated 
with the data reproduced by the reproducing apparatus. 
[01 56] A delete flag may be stored on the storage me- 
dium in response to deleting data from the reproducing 
apparatus. 

[0157] Information indicating that the data is trans- 
ferred or output from the reproducing apparatus may be 
stored on the storage medium. 

[01 58] Payment amount info mi ation may be stored on 
the storage medium in response to payment of a fee per- 
formed by the reproducing apparatus. 
[0159] According to still another aspect of the present 
invention, there is provided a control signal for control- 
ling a server apparatus to perform a process of deliver- 
ing data to a reproducing apparatus, the process com- 
prising an encrypting step for encrypting data and out- 
putting the resultant encrypted data; a transmitting step 
for transmitting the encrypted data; a recording step for 
recording, on a storage medium, a key used to decrypt 
the encrypted data; and a judging step for detecting un- 
authorized use of the data, on the basis of information 
stored on a storage medium returned from the repro- 
ducing apparatus. 

[01 60] According to still another aspect of the present 
invention, there is provided a control signal for control- 
ling a reproducing apparatus to which encrypted data is 
transmitted from a predetermined server apparatus and 
to which a storage medium including a key stored ther- 
eon for use in decrypting the encrypted data is sent, the 
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control signal serving to control the reproducing appa- 
ratus to perform a process of reproducing the data, the 
process comprising: a receiving step for receiving the 
encrypted data transmitted from the predetermined 
server apparatus; a reading step for reading the key 5 
stored on the storage medium; a decrypting step for de- 
crypting the encrypted data received in the receiving 
step, using the key read in the reading step; a controlling 
step for enabling or disabling reproduction of the data 
decrypted in the decrypting step, in accordance with the 10 
information recorded on the storage medium; and a re- 
producing step for reproducing the decrypted data, in 
accordance with the control in the controlling step. 
[0161] According to still another aspect of the present 
invention, there is provided a transmission data signal 15 
which is transmitted between a server apparatus and a 
reproducing apparatus in a data delivery system for de- 
livering encrypted data from the server apparatus to the 
reproducing apparatus, wherein the transmission data 
signal includes at least information indicating an identi- 20 
fier of the data, a key used to decrypt the data, and a 
reproduction condition of the data. 
[0162] In this transmission data signal, preferably, the 
information indicating the reproduction condition in- 
cludes information indicating a period during which the 25 
drtta is allowed to be reproduced. 

[0163] The information indicating the reproduction 
rend lion may include information indicating the number 
of nmos Ihe data is allowed to be reproduced. 
[0164] The information may include settlement infor- 30 
motion created in response to settlement associated 
with the data reproduced by the reproducing apparatus. 
[0165] The information may include a delete flag cre- 
ated n response to deleting the data from the reproduc- 
ing aoparatus. 35 
[0166] The information may include information gen- 
crated in response to outputting or transferring the data 
from the reproducing apparatus, so as to indicate that 
the data has been output or transferred. 
[0167] The information may include payment amount 40 
information created in response to payment of a fee per- 
fOTned by the reproducing apparatus. 
[0168] The invention will now be described by way of 
example with reference to the accompanying drawings, 
throughout which like parts are referred to by like refer- 45 
ences. and in which: 

Fig. 1 is a schematic diagram of a movie distribution 
system according to an embodiment of the present 
invention; 50 
Fig. 2 is a schematic diagram illustrating a movie 
distribution system according to a first embodiment 
of the present invention; 

Fig. 3 is a block diagram illustrating a server accord- 
ing to the first embodiment of the present invention; 55 
Fig. 4 is a block diagram illustrating a delivery card 
according to the first embodiment of the present in- 
vention; 



Fig. 5 is a block diagram illustrating a relay server 
according to the first embodiment of the present in- 
vention; 

Fig. 6 is a block diagram illustrating a playback ap- 
paratus according to the first embodiment of the 
present invention; 

Fig. 7 is a flow chart illustrating a process performed 
by the server according to the first embodiment of 
the present invention; 

Fig. 8 is a flow chart illustrating a process performed 
by the relay server according to the first embodi- 
ment of the present invention; 
Fig. 9 is a flow chart illustrating a process-per- 
formed by the playback apparatus according to the 
first embodiment of the present invention; 
Fig. 10 is a schematic diagram illustrating a movie 
distribution system according to a second embodi- 
ment of the present invention; 
Fig. 11 is a block diagram illustrating a server ac- 
cording to the second embodiment of the present 
invention; 

Fig. 12 is a block diagram illustrating a relay server 
according to the second embodiment of the present 
invention; 

Fig. 13 is a flow chart illustrating a process per- 
formed by the server according to the second em- 
bodiment of the present invention; 
Fig. 14 is a flow chart illustrating a process per- 
formed by the relay server according to the second 
embodiment of the present invention; 
Fig. 15 is a block diagram illustrating a server ac- 
cording to a third embodiment of the present inven- 
tion; 

Fig. 1 6 is a block diagram illustrating a delivery card 
according to the third embodiment of the present 
invention; 

Fig. 1 7 is a block diagram illustrating a playback ap- 
paratus according to the third embodiment of the 
present invention; 

Fig. 18 is a flow chart illustrating a process per- 
formed by the server according to the third embod- 
iment of the present invention; 
Fig. 19 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
third embodiment of the present invention; 
Fig. 20 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
third embodiment of the present invention; 
Fig. 21 is a block diagram illustrating a delivery card 
according to a fourth embodiment of the present in- 
vention; 

Fig. 22 is a block diagram illustrating a playback ap- 
paratus according to the fourth embodiment of the 
present invention; 

Fig. 23 is a flow chart illustrating a process per- 
formed by the server according to the fourth embod- 
iment of the present invention; 
Fig. 24 is a flow chart illustrating a process per- 
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formed by the playback apparatus according to the 
fourth embodiment of the present invention; 
Fig. 25 is a flow chart illustrating a process per- 
formed by the playback apparatus according to a 
fifth embodiment of the present invention; 5 
Fig. 26 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
fifth embodiment of^the present invention; 
Fig. 27 is a schematic diagram illustrating a movie 
distribution system according to a sixth embodi- 10 
ment of the present invention; 
Fig. 28 is a block diagram illustrating a server ac- 
cording to the sixth embodiment of the present in- 
vention; 

Fig. 29 is a block diagram illustrating a playback ap- is 
paratus according to the sixth embodiment of the 
present invention; 

Fig. 30 is a flow chart illustrating a process per- 
formed by the server according to the sixth embod- 
iment of the present invention; 20 
Fig. 31 is a flow chart illustrating a process per- 
formed by the server according to the sixth embod- 
iment of the present invention; 
Fig. 32 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 25 
sixth embodiment of the present invention; 
Fig. 33 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
sixth embodiment of the present invention; 
Fig. 34 is a schematic diagram illustrating a movie 30 
distribution system according to a seventh embod- 
iment of the present invention; 
Fig. 35 is a block diagram illustrating a delivery card 
and a playback card according to the seventh em- 
bodiment of the present invention; 35 
Fig. 36 is a block diagram illustrating a relay server 
according to the seventh embodiment of the 
present invention; 

Fig. 37 is a flow chart illustrating a process per- 
formed by the relay server according to the seventh 40 
embodiment of the present invention; 
Fig. 38 is a flow chart illustrating a process per- 
formed by the relay server according to the seventh 
embodiment of the present invention; 
Fig. 39 is a flow chart illustrating a process per- 45 
formed by the playback apparatus according to the 
seventh embodiment of the present invention; 
Fig. 40 is a schematic diagram illustrating a movie 
distribution system according to an eighth embodi- 
ment of the present invention; so 
Fig. 41 is a block diagram illustrating a relay server 
according to the eighth embodiment of the present 
invention; 

Figs. 42A and 42B are flow charts illustrating a proc- 
ess performed by the relay server according to the 55 
eighth embodiment of the present invention; 
Fig. 43 is a block diagram illustrating a delivery card 
and a playback card according to a ninth embodi- 



ment of the present invention; 
Fig. 44 is a block diagram illustrating a playback ap- 
paratus according to the ninth embodiment of the 
present invention; 

Fig. 45 is a flow chart illustrating a process per- 
formed by the relay server according to the ninth 
embodiment of the present invention; 
Fig. 46 is a flow chart illustrating a process per- 
formed by the relay server according to the ninth 
embodiment of the present invention; 
Fig. 47 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
ninth embodiment of the present invention; 
Fig. 48 is a block diagram illustrating a delivery card 
and a playback card according to a tenth embodi- 
ment of the present invention; 
Fig. 49 is a block diagram illustrating a playback ap- 
paratus according to the tenth embodiment of the 
present invention; 

Figs. 50A and 50B are flow charts illustrating a proc- 
ess performed by the relay server according to the 
tenth embodiment of the present invention; 
Fig. 51 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
tenth embodiment of the present invention; 
Fig. 52 is a block diagram illustrating a delivery card 
and a playback card according to an eleventh em- 
bodiment of the present invention; 
Figs. 53A and 53B are flow charts illustrating a proc- 
ess performed by the relay server according to the 
eleventh embodiment of the present invention; 
Fig. 54 is a flow chart illustrating a process per- 
formed by the playback apparatus according to the 
eleventh embodiment of the present invention; 
Fig. 55 is a schematic diagram illustrating an em- 
bodiment of the present invention; and 
Fig. 56 is a schematic diagram illustrating a conven- 
tional movie distribution system. 

[0169] Preferred embodiments of the present inven- 
tion are described in further detail below. First, the sys- 
tem configuration which is common for all embodiments 
is described. Thereafter, first to eleventh embodiments 
are described. Finally, specific examples of implemen- 
tations of the embodiments are described. 
[01 70] The respective embodiments will be described 
regarding the following items: 

[A(*)] Outline 

[B(*)] Configuration of Server 

[C(*)] Configuration of Card 

[D(*)] Configuration of Relay Server 

[E(*)] Configuration of Playback Apparatus 

[F(*)] Process Performed by Server 

[G(*)] Process Performed by Relay Server 

[H(*)] Process Performed by Playback Apparatus 

[!(*)] Advantages. 
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Herein, (*) denotes the embodiment number. More spe- 
cifically, the first to eleventh embodiments are denoted 
by embodiment numbers (1) to (11). 
[0171 ] In the respective embodiments, similar config- 
urations or similar processes will not be described in a 
duplicated fashion, unless necessary. 

System Configuration 

[0172] In each embodiment of a movie delivery sys- 
tem, a movie production company 500, movie delivery 
companies 501 , and movie theaters 502 are connected 
to one another, or at least movie delivery companies 501 
and movie theaters 502 are connected to one another, 
via a communication network such that data can be 
transmitted among them. 

[0173] For example, as shown in Fig. 1 , a movie pro- 
duction company 500, movie distribution companies 
501 , and movie theaters 502 are connected to one an- 
other via a transmission line 7 serving as a communica- 
tion network such that data can be transmitted among 
them. 

[0174] A movie is distributed to respective movie 
theaters 502 not via a film but in the form of content data. 
The content data is encrypted before being distributed. 
[0175] In each movie theater, the distributed movie is 
projected on a screen using not a film projector but a 
content data player Although it may be possible to 
project a movie on a screen in a movie theater 502 after 
converting content data into the form of a film, each em- 
bodiment described below is assumed to use a content 
data player to project a movie on a screen. 
[0176] The content data of a movie orthe like includes 
video data and audio data. The audio data may be of 
multi-channel data including, for example, 2, 3, 4, or 
greater number of channels. Furthermore, in order to 
use the content data in many countries, the content data 
may include multi-language information. 
[0177] The transmission line 7 serving as the commu- 
nication network may be a public communication net- 
work in a wire or wireless form . A private communication 
line may also be employed as the transmission line 7 for 
connection between a movie distribution company 501 
and a movie theater 502. 

[0178] For example, the Internet, a satellite commu- 
nication network, an optical fiber network, or other var- 
ious types communication lines can be used. 
[0179] In each embodiment, in addition to distribution 
of movie content data among the movie production com- 
pany 500, distribution companies 501 , and movie theat- 
ers 502, a storage medium is distributed separately from 
the movie content data. On the storage medium, as will 
be described in detail later, information about a condition 
under which a movie is to be played, information used 
to mange distribution, and key data (also referred to sim- 
ply as a key) used to decrypt encrypted content data are 
stored. 

[01 80] For example, a card medium may be employed 



as the storage medium and distributed (transported) as 
a delivery card from the movie production company 500 
to movie distribution companies 501 and furtherto mov- 
ie theaters 502. 

5 [0181] Alternatively, after distributing a storage medi- 
um in the form of a delivery card from the movie produc- 
tion company to the distribution companies 501 , a stor- 
age medium serving as a playback card may be deliv- 
ered from the movie distribution companies 501 to the 

10 movie theaters 502. 

[0182] As for the storage medium, various types of 
media such as a card medium, a disk medium, or a tape 
medium can be employed. In the embodiments de- 
scribed below, a card medium is employed by way of 

15 example. 

[0183] Various types of card media are available. 
They include a plastic card, a magnetic card, an IC card, 
and an optical card. In the embodiments described be- 
low, an IC card is employed by way of example. 

20 [0184] IC cards are classified into two types: a contact 
type in which metal terminals are exposed to the outside 
of a card; and a non-contact type in which data is trans- 
mitted via an electromagnetic wave. Each type of IC 
cards can be further classified into sub types. Herein, in 

25 each embodiment of the present invention, a contact- 
type memory card is employed. 

[0185] Note that the present invention is not limited to 
the contact-type memory card, but any type of storage 
medium can also be employed. 
30 [0186] In the case of contact-type IC cards, they are 
preferably capable of transmitting data at a frequency 
equal to or higher than 3.57 MHz and at a data trans- 
mission rate equal to or higher than 9.6 Kbps. 
[0187] The configurations and the operations of the 
35 server in the movie production company 500, the relay 
server in the movie distribution company 501 , and the 
playback apparatus in the movie theater 502 are de- 
scribed below for each embodiment. Note that in the 
present invention, the server and the relay sever are not 
40 necessarily required to be disposed in a separate fash- 
ion. For example, the movie production company 500 
may distribute a movie directly to movie theaters 502. 
In this case, the server of the movie production company 
500 also has functions of the relay server of the relay 
45 server of the movie distribution company 501 . 

[0188] The present invention is not limited to a movie 
distribution system but may also be applied to other var- 
ious systems in which data which needs high security is 
transmitted and also to various systems in which man- 
so agement of transmitted data is needed. 

First Embodiment 



55 



[A(1)] Outline 

[0189] A first embodiment of a movie distribution sys- 
tem is described below. First, the outline of this movie 
distribution system is described with reference to Fig. 2. 



14 



BNSDOCID: <EP 1 197965A2_L> 



27 



EP 1 197 965 A2 



28 



[0190] Fig. 2 illustrates flows of content data 5 and 
storage medium (delivery card 4) transmitted or trans- 
ported among a server 1 installed in a movie production 
company 500, relay server 2 installed in a movie distri- 
bution company 501, and a playback apparatus 3 in* 5 
stalled in a movie theater 502. 

[0191] Theserverl converts a movie film 5, which has 
been edited after being shot, into the form of content 
data 6 so as to be able to be transmitted via a transmis- 
sion line 7 to movie distribution companies 501 (which w 
are, for example, located in various countries and have 
a contract with the movie production company 500). 
[0192] In addition to the content data 6, the server 1 
also produces delivery cards 4 to be distributed to the 
movie distribution companies 501. In this production '5 
process, the server 1 produces as many delivery cards 
5 as there are movie theaters 502 to which delivery 
cards 5 will be finally distributed. Information, called ad- 
ditional information, associated with the content data 6 
is stored in each delivery card 4, as will be described in 20 
detail later. 

[0193] The server 1 encrypts the content data 1 and 
the associated additional information and transmits 
them to relay servers 2 of the respective movie distribu- 
tion companies 501. Furthermore, the server 1 also 25 
sends the required number of delivery cards 4 in which 
the additional information is stored to the respective 
movie distribution companies 501 . 
[0194] In each movie distribution company 501, the 
relay server 2 receives the transmitted content data 6 30 
and the associated additional information and also re- 
ceives the delivery card 4. 

[01 95] The relay server 2 performs a necessary proc- 
ess upon the content data 6 and the information stored 
on the delivery card 4. 35 
[0196] The relay server 2 then transmits the encrypt- 
ed content data 6 and the additional information to each 
theater movie 502 and also sends one delivery card 4 
in which the additional information is stored to each 
movie theater 502. 40 
[01 97] The playback apparatus 3 in each movie theat- 
er 502 receives the content data 6 and the associated 
additional information. The playback apparatus 3 reads 
the information stored on the delivery card 4. Using a 
key read from the delivery card 4, the playback appara- 45 
tus 3 decrypts the encrypted content data and additional 
information, and plays back the content data in accord- 
ance with the additional information read from the deliv- 
ery card 4. 

[0198] In each movie theater 502, when the predeter- 
mined playing period has expired, the content data 6 
stored in the playback apparatus 3 is deleted. Further- 
more, a delete flag in the delivery card 4 is set to indicate 
that the content data 6 has been deleted. 
[0199] Thereafter, the delivery cards 4 are returned to 
the movie distribution companies 501. The delivery 
cards 4 are then returned to the movie production com- 
pany 500. 



[0200] On the basis of the information stored on the 
returned delivery cards 4, the server 1 checks whether 
the distributed content data 6 has been used adequate- 
ly. More specifically for example, the server 1 checks 
whether the movie was played only during the allowed 
period according to the contract and whether the content 
data 6 has been correctly deleted after the expiration of 
the playing period. 

[B(1)J Configuration of Server 

[0201] The configuration of the server 1 is described 
below with reference to Fig. 3. 

[0202] The server 1 includes a film scanner 1 A, a dis- 
tribution managing unit 1B, a copyright managing unit 
1C, a return managing unit 1 D, a card controller 1 E, and 
a movie database 16. 

[0203] The film scanner 1A converts a movie film 5 
into the form of data which can be transmitted. To this 
end, the film scanner 1 A includes a digital video reading 
unit 18 for scanning an image formed on the film 5 and 
converting it into digital video data, and the film scanner 
1 A also includes a digital audio reading unit 17 for con- 
verting a sound track signal recorded on the film 5 into 
an audio signal and outputting the resultant signal. 
[0204] The digital video data and the digital audio data 
read from the movie film 5 are supplied to a compression 
coder 19 and converted into content data in a predeter- 
mined format. More specifically, the compression coder 
1 9 converts the input digital video data and digital audio 
data into compressed content data, for example, ac- 
cording to the MPEG standard. Note that there is no par- 
ticular restriction on the format of the content data. An- 
other format other than the MPEG format, such as the 
AVI format or the Window Media Technology format, 
may also be employed. 

[0205] The advantage obtained by compressing the 
data is that the amount of data to be transmitted can be 
reduced. However, the content data is not necessarily 
required to be compressed, as long as the content data 
can be used to play back a movie. 
[0206] The content data generated by the compres- 
sion coder 19 is stored in the movie database 16. 
[0207] That is, in the server 1 , a movie to be distrib- 
uted is converted, by the film scanner 1 A and the com- 
pression coder 19, into the form of content data and is 
stored in the movie database 16. This makes it possible 
to transmit the content data to movie distribution com- 
panies at a desired later time. 

[0208] The distribution managing unit 1 B controls and 
manages the distributing operation performed by the 
server 1 . To this end, the distribution managing unit 1B 
includes an input unttH, a storage unit 12, a distribution 
controller 13, a database controller 14, a modulator 30, 
and a transmission unit 31 . 

[0209] The input unit 11 is used by a human operator 
of the server 1 to input information concerning a distri- 
bution condition according to a distribution contract 
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made between a movie distribution company 501 and a 
movie theater 502 and additional information which will 
be described later. The input unit 11 is also used by the 
human operator to input a command indicating an op- 
eration to be performed by the server 1 . 
[021 0] For example, the information input via the input 
unit 11 as the additional information associated with one 
movie content includes a content ID uniquely assigned 
to the movie content, a destination identifier ID1 serving 
as an identifier of a movie distribution company 501 (re- 
lay server 1) to which the movie content is to be trans- 
mitted, a destination identifier 1D2 serving as an identi- 
fier of a movie theater 502 (playback apparatus 3) to 
which the movie content is to be transmitted, and sched- 
ule information indicating a playing period during which 
the movie content is to be played back in the movie 
theater 502. 

[0211] The information input via the input unit 11 is 
stored in the storage unit 12. 

[0212] The distribution controller 13 controls various 
parts so that the content data is distributed in an ade- 
quate fashion in accordance with an operation com- 
mand input via the input unit 11 and also in accordance 
with the information such as the schedule information 
stored in the storage unit 12. 

[0213] The database controller 14 controls the oper- 
ation of the film scanner 1A and the operation of the 
movie database 16. For example, when information as- 
sociated with a movie, such as a content ID, a destina- 
tion identifier ID1 , a destination identifier ID2, and 
schedule information, is input via the input unit 11, the 
database controller 14 controls the film scanner 1 A so 
as to convert the movie indicated by the content ID into 
content data and then controls the movie database 16 
so as to stores the resultant content data. Note that the 
content ID, the destination identifier ID1 , the destination 
identifier ID2, the schedule information, associated with 
each movie, are stored : in advance, in the storage unit 
1 2 or on another storage medium so that when a movie 
recorded on a film 5 is converted into the form of content 
data, the content ID of that movie can be selected au- 
tomatically or in accordance with a selection command 
input via the input unit 11. 

[0214] Furthermore, in the above operation, the data- 
base controller 14 also controls the operation such that 
the information such as the content ID which is retained 
in the storage unit 1 2 after being input via the input unit 
11 (or which is selected from the stored data) is stored 
as the additional information associated with the content 
data into the movie database 16. 

[0215] Still furthermore, in response to a command is- 
sued by the distribution controller 1 3, the database con- 
troller 14 controls the operation such that content data 
and associated additional data are read or rewritten 
from or to the movie database 16 or such that content 
data and associated additional data are transmitted to 
the modulator 30. 

[0216] The modulator 30 modulates the content data 
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read from the movie database 1 6, by means of, for ex- 
ample, PSK modulation so as to convert the content da- 
ta into a form which can be transmitted. After being mod- 
ulated by the modulator 30, the modulated content data 
is transmitted from the transmission unit 31 over the 
transmission line 7 to the relay server 2 of each movie 
distribution company 501 . 

[0217] In the above distribution process, the content 
data read from the movie database 16 is encrypted by 
an encryption unit 22 of the copyright managing unit 10 
and the resultant encrypted content data is again stored 
into the movie database 16. A specified encrypted con- 
tent data is read from the movie database 1 6 and trans- 
mitted from the transmitting unit 31 . When content data 
is distributed, an encrypted content ID, an encrypted 
destination identifier ID1 , an encrypted destination iden- 
tifier ID2, and encrypted schedule information corre- 
sponding to the encrypted content data are added as 
additional information (encrypted additional informa- 
tion) to the encrypted content data, and they are trans- 
mitted together. 

[0218] The copyright managing unit 1 C maintains se- 
curity of copyright by encrypting the content data and 
associated additional data. 

[0219] The copyright managing unit 1 C includes a key 
generators 23 and 24 and encryption units 22 and 25. 
[0220] The key generator 23 generates an encryption 
key AK1 for use in encryption of the content data and 
associated additional data and also generates a decryp- 
tion key DK1 for use in decryption of data encrypted us- 
ing the encryption key AK1 . The encryption key AK1 is 
supplied to the encryption unit 22, and the decryption 
key DK1 is supplied to the encryption unit 25. 
[0221] When the encryption unit 22 receives the con- 
tent data and the associated additional information 
which are read from the movie database 16 under the 
control of the distribution controller 1 3 and the database 
controller 14, the encryption unit 22 encrypts the re- 
ceived content data and additional information, using 
the encryption key AK1 . 

[0222] The encrypted content data and additional in- 
formation are returned to the movie database 16 and 
stored therein as data for use of distribution. The en- 
crypted additional information is also supplied to the 
card controller 1E. 

[0223] The key generator 24 generates an encryption 
key AK2 used to encrypt an encryption key AK1 and also 
generates a decryption key DK2 used to decrypt data 
encrypted using the encryption key AK2. The encryption 
key AK2 is supplied to the encryption unit 24, and the 
decryption key DK2 is supplied to the schedule manag- 
ing unit 26 in the return managing unit 1D. 
[0224] When the encryption unit 24 receives the de- 
cryption key DK1 generated by the key generator 23, 
the encryption unit 24 encrypts the received decryption 
key DK1 using the encryption key AK2. The resultant 
encrypted decryption key DK1 is supplied to the card 
controller 1 E. 
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[0225] The card controller 1 E serves to read and write 
data from or to the delivery card 4. To this end, the card 
controller 1 E includes a card read/write controller 20 and 
a card interface 21 . 

[0226] Under the control of the card read/write con- 
troller 20, the card interface 21 gets access to an insert- 
ed delivery card to read or write data such as additional 
information from or to the delivery card 4. 
[0227] Furthermore, the card controller 1 E produces 
a delivery card 4, which is to be delivered to the distri- 
bution company 501 separately from the transmission 
of the content data thereto, by writing, into a new blank 
card 4, the additional information encrypted using the 
encryption key AK1 and the decryption key DK1 en- 
crypted using the encryption key AK2. The card control- 
ler 1 E also reads the additional information stored in a 
delivery card 4 returned from the movie theater 502 or 
the distribution company 501 . 

[0228] The return managing unit 1 D serves to exam- 
ine the additional information stored on a returned de- 
livery card 4 to check whetherthe content data has been 
used in an authorized manner (in the playing-back op- 
eration at the movie theater 502) and check whether 
there is any problem. To this end, the return managing 
unit 1 D includes a schedule managing unit 26, a decryp- 
tion unit 27, a judgment unit 28, and an output unit 2g. 
[0229] The schedule managing unit 26 checks and 
manages the additional information associated with 
each content data stored in the storage unit 12, and also 
manages, together with the content ID, the decryption 
key DK2 which is generated by the key generator 24 in 
correspondence with the content data and the associ- 
ated additional information. 

[0230] When the additional information is read from 
the delivery card 4, the decryption unit 27 decrypts the 
encrypted decryption key DK1 stored in the delivery 
card 4, using the decryption key DK2 managed by the 
schedule managing unit 26. Using the decryption key 
DK1 decrypted by the decryption unit 27, it is possible 
to decrypt the encrypted additional information stored in 
the delivery card 4. 

[0231] When a returned delivery card 4 is inserted in 
the card controller 1 E and information stored thereon is 
read, the judgment unit 28 judges whether the corre- 
sponding content data has been correctly used in an au- 
thorized fashion by comparingthe additional information 
read from the delivery card 4 with the additional infor- 
mation stored in the managing unit 26; checking the con- 
tent of the additional information itself; or examining the 
payment status of the movie theater 502 by checking 
the account of the movie theater 502 via communication 
with the bank center 550. 

[0232] The output unit 29 serves to output the result 
of the judgment made by the judgment unit 28 concern- 
ing the management status or unauthorized use. For ex- 
ample, a monitor device or a printer may be employed 
as the output unit 29. The output unit 29 may output an 
invoice, a demand letter, a warning message or the like. 
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[C(1 )] Configuration of Card 

[0233] When a contact-type IC card is employed as 
the delivery card 4, the delivery card 4 may be config- 
5 ured, for example, as shown in Fig. 4. The delivery card 
4 may be connected to thecard interface 21 of the server 
1 to write/read information. To write/read information, 
the delivery card 4 may also be connected to the relay 
server 2 or the playback apparatus 3, which will be de- 
10 scribed later. 

[0234] The delivery card 4 includes an interface 41 , a 
memory access controller 42, and a memory 43. 
[0235] The interface 41 is connected to the card inter- 
face 21 of the server 1 or the card interface 111 or 211 
15 of the relay server 2 or the playback apparatus 3 which 
will be described later so that various kinds of informa- 
tion and control signals can be transferred. More spe- 
cifically for example, the interface 41 transmits informa- 
tion to be recorded as additional information and han- 
dles, adjusts or provides the operation clock, the access 
control signal, and the supply voltage. 
[0236] The memory access controller 42 gets access 
to the memory 43 to read or write data from or to the 
memory 43 in response to a request (control signal) is- 
sued from a device to which the delivery card 4 is con- 
nected. 

[0237] The memory 43 is formed of, for example, a 
memory device such as a flash memory. 
[0238] Various kinds of information are stored in the 
memory 43 as shown in the figure. More specifically, the 
memory 43 stores the decryption key DK1 encrypted us- 
ing the encryption key AK2 and also stores the addition- 
al information, such as the content ID, the destination 
identifier ID1, the destination identifier ID2, and the 
schedule information, encrypted using the encryption 
key AK1 . 

[0239] Various kinds of flags are also stored in the 
memory 43 during the operation of the relay server 2 or 
the playback apparatus 3. For example, when the con- 
tent data distributed to the playback apparatus 3 is de- 
leted after expiration of the playing period, the delete 
flag (deletion-from-playback-apparatus flag) is written. 
On the other hand, when the content data distributed to 
the relay server 2 is deleted, the delete flag (deletion- 
from-relay-server flag) is written. 
[0240] When settlement is performed by the playback 
apparatus 3, a settlement completion flag is written. 
[0241] The deletion-from-playback-apparatus flag is 
represented by two bits stored in a particular area of the 
memory 43. For example, "10" indicates that the data 
has not yet been deleted, and "11" indicates that the da- 
ta has been deleted. When the delivery card 4 is inserted 
into the playback apparatus 4 for the first time, the play- 
back apparatus 3 writes "10" in the deletion-from-play- 
back-apparatus flag. Thereafter, if the content data is 
deleted by the playback apparatus 3, the deletion-from- 
playback-apparatus flag is changed to "11". Before the 
delivery card 4 is inserted into the playback apparatus 
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3 after being received, the playback apparatus flag has 
a value of "00". In the present description, "there is no 
deletion-from-playback-apparatus flag" or a similar ex- 
pression is used to describe that "00" is stored in the 
storage area assigned to the deletion -from -pi ay back- 
apparatus flag. 

[0242] Similarly, the deletion-from-reJay-server flag 
may take a value as follows. When the delivery card 4 
is inserted into the relay server 2 for the first time, the 
flag is set so as to have a value of "1 0". When the content 
data is deleted from the relay server 2, the value of the 
flag is changed to "11". 

[D(1)J Configuration of Relay Server 

[0243] Fig. 5 illustrates a configuration of the relay 
server 2. 

[0244] A receiving unit 101 serves to receive data 
transmitted via the transmission line 7. More specifically, 
in this example, the receiving unit 101 receives the con- 
tent data transmitted by the server 1 . 
[0245] A demodulator 102 demodulates the data re- 
ceived by the receiving unit 1 01 . Because the received 
data is PSK-modulated data, the demodulation is per- 
formed by means of PSK demodulation. As a result of 
the demodulation, the encrypted content data and the 
encrypted additional information transmitted from the 
server 1 are obtained. 

[0246] Under the control of the card read/write con- 
troller 105, the card interface 111 gets access to an in- 
serted delivery card 4 to read or write data such as ad- 
ditional information from or to the delivery card 4. 
[0247] More specifically, for example, the card inter- 
face 111 gets access to a delivery card 4 delivered from 
the server 1 or a delivery card 4 returned from a movie 
theater 502 and reads or writes additional information, 
a decryption key, and various flags. 
[0248] A decryption unit 1 03 decrypts encrypted data 
such as the encrypted content data or the encrypted ad- 
ditional information obtained via the demodulation per- 
formed by the demodulator 102 or the encrypted addi- 
tional information or flag read from the delivery card 4 
via the card read/write controller 105. 
[0249] The decryption key DK1 is necessary to de- 
crypt the content data and additional information en- 
crypted using the encryption key AK1 . The decryption 
key DK1 can be obtained by reading it from the delivery 
card 4. However, because the decryption key DK1 read 
from the delivery card 4 has a form encrypted using the 
encryption key AK2, a decryption key DK2 is necessary 
to decrypt the decryption key DK1 . 
[0250] A key generator 1 04 serves to generate the de- 
cryption key DK2. The key generator 1 04 generates the 
same decryption key DK2 as that generated by the key 
generator 24 of the server 1 . In the above encryption, a 
symmetric key encryption technique may be employed. 
In this case, during a predetermined period, both the key 
generator 24 of the server 1 and the key generator 1 04 
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of the relay server 2 generate the same decryption key 
DK2. Alternatively, a public key encryption technique 
may be employed. 

[0251] In this movie distribution system, the scheme 
s of generating keys is determined so that the decryption 
key DK1 corresponding to the decryption key DK2 can 
be identified. 

[0252] The decryption unit 1 03 can obtain the decryp- 
tion key DK1 using the decryption key DK2 which is gen- 
10 erated by the key generator 1 04 and supplied to the de- 
cryption unit 103 via the card read/write controller 105. 
That is, it becomes possible to decrypt the encrypted 
decryption key DK1 read from the delivery card 4. Ob- 
taining the decryption key DK1 then makes it possible 
to decrypt the encrypted content data and the encrypted 
additional information which have been demodulated by 
the demodulator 102 and makes it possible to decrypt 
the encrypted additional information and flags which are 
read from the delivery card 4 via the card read/write con- 
troller 105. 

[0253] The authentication/write controller 106 per- 
forms various processes including authentication and 
judgment concerning the obtained additional informa- 
tion. Furthermore, the authentication/write controller 
106 controls the writing of the content data or the addi- 
tional information, depending upon the results of the au- 
thentication and the judgment in accordance with the 
control program. 

[0254] The content data and associated additional in- 
formation, which have been demodulated and decrypt- 
ed after being received from the server 1 . are encrypted 
by the encryption unit 108 under the control of the au- 
thentication/write controller 1 06 and stored into the com- 
pressed data storage unit 109. Thus, the compressed 
data storage unit 1 09 serves to store the content data 
and associated additional information which have been 
converted into an encrypted form so as to be able to be 
transmitted to the movie theaters 502. 
[0255] As for the compressed data storage unit 1 09, 
for example, a built-in hard disk may be employed. Al- 
ternatively, a removable storage medium such as a re- 
movable hard disk, optical disk, magneto-optical disk, 
semiconductor memory, or magnetic tape (video tape) 
may also be employed. 

[0256] As for additional information which is demod- 
ulated and decrypted after being received and as for ad- 
ditional information which is decrypted after being read 
from the delivery card 4, the authentication/write con- 
troller 106 controls the process such that the additional 
information is stored in the storage unit 110 without be- 
ing encrypted. 

[0257] Depending upon the authentication result con- 
cerning the additional information read from the delivery 
card 4, additional information and various flags are set 
and encrypted by the encryption unit 1 1 6 under the con- 
trol of the authentication/write controller 1 06. The result- 
ant data is written into the delivery card 4 via the card 
read/write controller 105 and the card interface 111 . 
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[0258] A relay server ID uniquely assigned to the relay 
server 2 is stored in the relay server ID storage unit 1 07. 
The authentication/write controller 106 also judges 
whether the destination identifier ID1 described in the 
additional information is consistent with the relay server 
ID. 

[0259] In encryption performed by the encryption 
units 108 and 116, the encryption key AK1 is used. To 
this end. although not shown in the figure, there is pro- 
vided a key generator for generating the same encryp- 
tion key AK1 as that generated by the key generator 23 
of the server 1. Alternatively, the encryption key AK1 
may be generated on the basis of the decryption key 
DK1 such that the encryption key AK1 corresponds to 
the decryption key DK1 . 

[0260] In the case the delivery card 4 is a card re- 
turned from the playback apparatus 3, the content ID in 
the additional information stored in the delivery card 4 
has been converted by the playback apparatus 3 into a 
non-encrypted form, although the other data of the ad- 
ditional information is maintained in the encrypted form. 
This makes it possible for the relay server 2 to recognize 
the content ID of the returned delivery card without hav- 
ing to use the decryption key DK2. 
[0261] When the decryption key DK1 read from the 
delivery card 4 received from the server 1 is decrypted 
using the decryption key DK2 generated by the key gen- 
erator 104 and then the additional information is de- 
crypted using the decryption key DK1 , the authentica- 
tion/write controller 106 stores the decryption key DK2, 
in correspondence with the associated content ID, into 
an internal memory so that they can be used later to 
decrypt the encrypted additional information and flags 
read from the returned delivery card 4. This makes it 
possible to determine the decryption key DK2 on the ba- 
sis of the unencrypted content ID, when the delivery 
card 4 is returned from the movie theater 502. Thus, it 
becomes possible to decrypt the decryption key DK1 
and further decrypt other encrypted additional informa- 
tion and flags using the obtained decryption DK1 . 
[0262] I n the relay server 2 } when the card information 
is rewritten to add a flag or the like to a returned delivery 
card 4, the content ID is not encrypted so that when the 
delivery card 4 is returned to the server 1 . the server 1 
can read the content ID of the returned delivery card 4 
without having to use the decryption key. 
[0263] The distribution controller 1 1 2 controls the op- 
eration of transmitting content data and associated ad- 
ditional information to a playback apparatus 3 of a movie 
theater 502. 

[0264] The database controller 1 1 3 controls the oper- 
ation of writing and reading data into or from the com- 
pressed data storage unit 109. 

[0265] From data, such as schedule information, of 
the additional information stored in the storage unit 110, 
the distribution controller 112 detects content data and 
date/time at which that content data should be transmit- 
ted. If content data is detected which should be trans- 



mitted at the present time, the distribution controller 112 
requests the database controller 1 1 3 to retrieve the con- 
tent data to be transmitted. The obtained encrypted con- 
tent data and associated additional information are sup- 

5 plied to the modulator 1 1 4. 

[0266] The modulator 114 modulates the content data 
and the additional information read from the com- 
pressed data storage unit 109, by means of, for exam- 
ple, PSK modulation so as to convert the data into af orm 

10 which can be transmitted. After being modulated by the 
modulator 114, the modulated content data is transmit- 
ted from the transmission unit 115 via the transmission 
line 7 to the playback apparatus 3 of each movie theater 
502. 

15 

[E(1)] Configuration of Playback Apparatus 

[0267] Fig. 6 illustrates the structure of the playback 
apparatus 3. 

[0268] A receiving unit 201 serves to receive data 
transmitted via a transmission line 7. More specifically, 
the receiving unit 201 receives content data and asso- 
ciated additional information transmitted from the relay 
server 2. 

[0269] A demodulator 202 demodulates the data re- 
ceived via the receiving unit 201 . Because the received 
data is PSK-modulated data, the demodulation is per- 
formed by means of PSK demodulation. Thus, via the 
demodulation process described above, the encrypted 
content data and associated additional information 
transmitted from the relay server 2 are obtained. 
[0270] Under the control of the card read/write con- 
troller 205 ; the card interface 211 gets access to an in- 
serted delivery card 4 to read or write data such as ad- 
ditional information from or to the delivery card. 
[0271] More specifically, the card interface 211 gets 
access to the delivery card 4 returned from the relay 
server 2 to read the additional information and the de- 
cryption key and also writes the additional information 
including a deletion-from-playback-apparatus flag or a 
settlement completion flag which has been set to a par- 
ticular value. 

[0272] A decryption unit 203 decrypts encrypted data 
such as the encrypted content data and the encrypted 
additional information obtained via the demodulation 
performed by the demodulator 202 or decrypts the en- 
crypted additional information or flag read from the de- 
livery card 4 via the card read/write controller 205. 
[0273] Also in this case, as in the process performed 
by the relay server 2, the decryption key DK1 is neces- 
sary to decrypt the content data and additional informa- 
tion encrypted using the encryption key AK1 . The de- 
cryption key DK1 can be obtained by reading it from the 
delivery card 4. However,' because the decryption key 
DK1 read from the delivery card 4 has a form encrypted 
using the encryption key AK2, a decryption key DK2 is 
necessary to decrypt the decryption key DK1 . 
[0274] For the above reason, a key generator 204 
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generates the decryption key DK2. The key generator 
204, like the key generator 104 of the relay server 2, 
generates the decryption key DK2 identical to that gen- 
erated by the key generator 24 of the server 1 . In the 
above encryption, a symmetric key encryption tech- 5 
nique may be employed. In this case, during a prede- 
termined period, both the key generator 24 and the key. 
generator 104 generate the same decryption key DK2. 
Alternatively, a public key encryption technique may be 
employed. 10 
[0275] The decryption unit 203 can obtain the decryp- 
tion key DK1 using the decryption key DK2 which is gen- 
erated by the key generator 204 and which is supplied 
to the decryption unit 203 via the card read/write con- 
troller 205. That is, the decryption unit 203 can obtain is 
the decryption key DK1 by decrypting the encrypted key 
DK1 read from the delivery card 4. Obtaining the decryp- 
tion key DK1 makes it possible to decrypt the encrypted 
content data and the encrypted additional information 
which have been demodulated by the demodulator 202 20 
and makes it possible to decrypt the encrypted addition- 
al information which is read from the delivery card 4 via 
the card read/write controller 205. 
[0276] The authentication/write controller 206 per- 
forms various processes including authentication of the 25 
obtained additional information. The authentication/ 
write controller 206 also judges whether the additional 
information read from the delivery card 4 is consistent 
with the additional information obtained via the trans- 
mission. Furthermore, the authentication/write/delete 30 
controller 206 controls the writing of the content data or 
the additional information, depending upon the results 
of the authentication and the judgment in accordance 
with the control program. 

[0277] More specifically for the content data and the 35 
associated additional information which have been de- 
modulated and decrypted after being received from the 
relay server 2, the authentication/write/delete controller 
206 writes them into the compressed data storage unit 
208. The compressed data storage unit 208 serves to 40 
store content data and associated additional information 
which have been converted into a decrypted form so as 
to be capable of being played back by the playback ap- 
paratus 3. 

[0278] Alternatively, the content data may be stored 45 
in the form of encrypted data in the compressed storage 
unit 208. In this case, the content data is decrypted when 
it is played back. 

[0279] The additional information which has been de- 
modulated and decrypted after being received via trans- so 
mission and the additional information which has been 
decrypted after being read from the delivery card 4 are 
stored in the storage unit 209 under the control of the 
authentication/write/delete controller 206. 
[0280] As for the compressed data storage unit 208, 55 
for example, a built-in hard disk may be employed. Al- 
ternatively, a removable storage medium such as a re- 
movable hard disk, optical disk, magneto-optical disk, 



semiconductor memory, or magnetic tape (video tape) 
may also be employed. Employing a removable storage 
medium allows a human operator to manage content 
data in units of media. Furthermore, the content data 
can be easily played back simply by inserting the stor- 
age medium. In this case, desired content data can be 
easily and correctly selected without having to perform 
retrieval, unlike the case in which a large-capacity hard 
disk is employed. 

[0281] In the case where a flag such as the deietion- 
from-playback-apparatus flag or the settlement comple- 
tion flag is stored in the delivery card 4, the authentica- 
tion/write/delete controller 206 re-determines the value 
of the flag. The resultant flag is encrypted by the encryp- 
tion unit 220 together with the otherdata of the additional 
information and written into the delivery card 4 via the 
card read/write controller 205 and the card interface 
211. 

[0282] When the information written in the delivery 
card 4 is re-written in the above-described process, the 
content ID is not encrypted so that when the delivery 
card 4 is returned to the relay server 2, the relay server 
2 can recognize the content ID of the returned delivery 
card without having to use the decryption key. 
[0283] A playback apparatus ID uniquely assigned to 
the playback apparatus 3 is stored in a playback appa- 
ratus ID storage unit 207. The authentication/write/de- 
lete controller 206 also judges whether the destination 
identifier ID2 described in the additional information is 
consistent with the playback apparatus ID. 
[0284] In encryption performed by the encryption unit 
220, the encryption key AK1 is used. To this end, al- 
though not shown in the figure, there is provided a key 
generator for generating an encryption key AK1 identi- 
cal to that generated by the key generator 23 of the serv- 
er 1 . Alternatively, the encryption key AK1 may be gen- 
erated on the basis of the decryption key DK1 such that 
the encryption key AK1 corresponds to the decryption 
key DK1 . 

[0285] A playback controller 214 controls the opera- 
tion performed by the playback apparatus 3 to play back 
content data. 

[0286] The database controller 21 5 controls the oper- 
ation of writing and reading data into or from the com- 
pressed data storage unit 208. 

[0287] In accordance with the additional information 
such as schedule information stored in the storage unit 
209 and in response to a command issued from the user 
control unit 210, the playback controller 214 detects a 
contentto be played back, a playing period during which 
the content is allowed to be played back, and a time at 
which playback is to be started. When content data is 
played back, the playback controller 214 retrieves, via 
the database controller 215, the content data to be 
played back. The retrieved content data is supplied to a 
digital projector 3a. 

[0288] The digital projector 3a is a part in the playback 
apparatus which actually plays back the content data 
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and which includes a data separating unit 21 6 : a decom- 
pression unit 21 7, a D/A converter 21 8, and a projection 
unit 21 9. 

[0289] The data separating unit 216 separates the 
content data supplied from the compressed data stor- 
age unit 208 into video data and audio data. 
[0290] The decompression unit 21 7 decodes the vid- 
eo data and the audio data so as to decompress them. 
[0291] The decompressed video data and audio data 
are then converted by the D/A converter into an analog 
video signal and an analog audio signal and reproduced 
by the playback unit 21 9. The playback unit 21 9 not only 
serves as a video projector for forming a projected im- 
age but also serves to output an audio sound thereby 
playing a movie. 

[0292] The user control unit 210 is used by a human 
operator to issue various commands or data to the play- 
back apparatus 3. Under the control of the display con- 
troller 21 2, the display unit 213 displays formation such 
as the additional information stored in the storage unit 
209 so that the human operator can read the informa- 
tion. The display unit 213 also displays an operation 
guide or various menus. 

[0293] The user control unit 210 is used to issue var- 
ious commands such as a command to play back con- 
tent data stored in the compressed data storage unit 
208, a command to delete content data whose playing 
period has expired, a command to end a process, or a 
command to pay a fee. 

[0294] When a command to delete content data is is- 
sued, the playback controller 214 commands the data- 
base controller 215 to delete the specified content data 
from the compressed data storage unit 208. 
[0295] A charge controller 221 performs a payment 
process in response to a pay command issued from the 
user control unit 210. For example, the charge controller 
221 communicates with the bank center 550 and sends 
money into an account of the movie distribution compa- 
ny 501 or the movie production company 500 thereby 
paying a fee to the movie distribution company 501 or 
the movie production company 500 in accordance with 
the a contract. 

[F(1)] Process Performed by Server 

[0296] The process performed by the server 1 is de- 
scribed below with reference to a flow chart shown in 
Fig. 7. 

[0297] In step F1 , it is determined whether a human 
operator of the server 1 has input, via the input unit 1 1 , 
a content ID, a destination identifier ID1, a destination 
identifier ID2, and schedule information associated with 
a movie content. If yes, the process proceeds to step 
F2. However, if it is determined in step F1 that no infor- . 
mation has been input, the process jumps to step F7. 
[0298] As described earlier, the content ID is an iden- 
tifier uniquely assigned to a movie content. The desti- 
nation identifier ID1 is a relay server ID of a relay server 



2, and the destination identifier ID2 is a playback appa- 
ratus ID of a playback apparatus 3 of a movie theater 
502 to which movie content is finally supplied. 
[0299] The schedule information has a value such as 
5 "2000.01.01-2000.04.30" indicating a playing period 
during which the movie is permitted to be played by the 
movie theater 502 in accordance with a contract. 
[0300] In step F2, the information input via the input 
unit 1 1 , that is, the additional information, is stored in the 
10 storage unit 12. 

[0301] Thereafter, in step F3 : the distribution control- 
ler 13 transmits a content data write command to the 
film scanner 1 A and the movie database 1 6 via the da- 
tabase controller 14. 
15 [0302] Instep F4,in response to the content data write 
command, the digital audio reader 1 7 of the film scanner 
1 A reads digital audio data from the film 5, and the digital 
video data reader 18 reads digital video data from the 
film 5. The resultant digital audio data and digital video 
data are transmitted to the compression encoder 19. 
[0303] In step F5, the compression encoder 1 9 com- 
presses the digital audio data and the digital video data 
according to, for example, the MPEG standard thereby 
producing content data in the MPEG format. The result- 
ant compressed content data is supplied to the movie 
database 16. 

[0304] Herein, the digital audio data includes 8-chan- 
nel data, and also includes a copy inhibition flag to pre- 
vent the digital audio data from being digitally copied. 
Copy control information may be embedded in the form 
of a digital watermark in the digital audio data. 
[0305] In step F6, the compressed content data is 
stored in the movie database 1 6 together with the asso- 
ciated additional information such as the content ID 
stored in the storage unit 12. Thereafter, the process 
proceeds to step F7. 

[0306] The process has been described above which 
is performed when additional information such as a con- 
tent ID is input via the input unit 11 . 
[0307] When the above-described process started in 
response to the information input by the human operator 
is completed, or when no information is input by the hu- 
man operator, the process proceeds to step F7 in which 
the card read/write controller 20 judges, via the card in- 
terface 21 . whether a delivery card 4 is inserted. 
[0308] An inserted delivery card 4 is detected, the 
process proceeds to step F8. However, it is determined 
that no delivery card is inserted, the process jumps to 
step F24. 

[0309] In step F7 described above, authentication of 
the human operator may be performed to confirm that 
the human operator is an authorized operator of the de- 
livery card 4. Authentication may be performed by ask- 
ing the operator to input his/her personal ID and/or pass- 
word, and verifying the input data. To this end, an ID 
and/or a password corresponding to the operator may 
be stored in the delivery card 4 or the storage unit 12. 
[0310] Preferably, the delivery card 4 shown in Fig. 4 
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is constructed such that the additional information 
stored in the storage unit 12 cannot be transferred into 
the delivery card 4 unless the authentication of the user 
is successfully passed. 

[0311] Similar authentication may be performed in 
other embodiments which will be described later, or may 
be performed when a process associated with the de- 
livery card 4 is performed in the relay server 2 or the 
playback apparatus 3. 

[0312] In the case where the delivery card 4 is insert- 
ed, the card read/write controller 20 reads, in step F8, 
the information stored in the delivery card 4 to determine 
whether the delivery card 4 is a new card. Herein, the 
"new card" refers to a blank card in which no information 
such as additional information or a decryption key DK1 
has not yet been written and which is inserted to produce 
a delivery card 4 which will be sent to a relay server 2 
in parallel with transmission of content data. 
[0313] If the inserted delivery card 4 is one which has 
been returned from a movie distribution company 501 
(or a movie theater 502), it is determined that the deliv- 
ery card 4 is not a new card. 

[031 4] If the inserted delivery card 4 is determined as 
a new card ; the process proceeds to step F9. However, 
in the case where the inserted delivery card 4 is deter- 
mined as a returned card, the process jumps to step 
F18. 

[0315] In the case where the process has proceeded 
to step F9 as a result of the determination that the de- 
livery card 4 is a new card, the distribution controller 13 
determines whether it is time to send the delivery card. 
[031 6] For example, if schedule information associat- 
ed with a content data is given as 
"2000.01 .01 -2000.04.30", it is determined that the card 
should be delivered after 1 999.1 2.01 . That is, taking into 
account the time needed to transmit the content and the 
time needed to deliver the delivery card 4, a sufficiently 
early date with respect to the date at which the movie is 
to be started to be played is determined as the card de- 
livery date. In the case where it is determined that it is 
time to send the card, the process proceeds to step F1 0. 
However, if it is determined that it is not time to send the 
card, the process jumps to step F24. 
[0317] In the case where the process has proceeded 
to step F10 as a result of the decision that it is time to 
send the card, the database controller 1 4 retrieves, from 
the movie database 16, content data corresponding to 
the content ID which has been determined as being re- 
quired to be sent, in accordance with the schedule in- 
formation. 

[031 8] Then in step F1 1 , the additional information as- 
sociated with the content ID and stored in the storage 
unit 12 is transferred to the encryption unit 22. Further- 
more, the compressed content data corresponding to 
the content ID, retrieved from the movie database 1 6, is 
transmitted to the encryption unit 22. 
[0319] Thereafter, in step F12, the encryption unit 22 
encrypts the received compressed content data and as- 



sociated additional information, using the encryption 
key AK1 generated by the key generator 23. 
[0320] In step F1 3, the content data and additional in- 
formation encrypted using the encryption key AK1 are 
5 stored in the movie database 16. 

[0321] In step F14, the additional information encrypt- 
ed using the encryption key AK1 is supplied to the card 
read/write controller 20 and written, via the card inter- 
face 21 , into the inserted new card. 

10 [0322] In step F15, the encryption unit 25 encrypts, 
using the encryption key AK2 generated by the key gen- 
erator 24, the decryption key DK1 generated by the en- 
cryption unit 23. In step F1 6, the decryption key F1 6 en- 
crypted using the encryption key AK2 is supplied to the 

15 card read/write controller 20 and is written, via the card 
interface 21 , into the inserted new card. 
[0323] In the process described above, the encrypted 
decryption key DK1 and the encrypted additional infor- 
mation are written in the inserted new card, thereby pro- 

20 ducing a delivery card 4 such as that shown in Fig. 4 to 
be delivered to a relay server 2 or a playback apparatus 
3. In the example shown in Fig. 4, various flags are 
stored in the delivery card 4. Note that these flags are 
written by the relay server 2 or the playback apparatus 

25 3, as described earlier. 

[0324] After producing the delivery card 4, the proc- 
ess proceeds to step F17. In step F17, the schedule 
managing unit 26 stores the decryption key DK2 togeth- 
er with the additional information stored in the storage 

30 unit 12. 

[0325] In the present embodiment, as described 
above, the server 1 produces the delivery card 4 by writ- 
ing the additional information and the decryption key into 
a new card. Alternatively, the delivery card 4 may be pro- 

35 duced by the relay server 2. In this case, steps F8 to 
F16 in Fig. 7 are performed by the relay server 2. 
[0326] In the case where the card read/write controller 
20 determines in step F8 that the inserted card is not a 
new card, that is. if the inserted card is determined as a 

40 delivery card 4 which has been returned from the relay 
server 2 orthe playback apparatus 3 and which includes 
already-written additional information, the process pro- 
ceeds to step F 18. 

[0327] In step F18, the card read/write controller 20 
45 reads, from the delivery card 4, the encrypted decryption 
key DK1 , the encrypted additional information, and the 
content ID which is not encrypted when the delivery card 
4 is returned. 

[0328] In step F19, the decryption key DK2 corre- 
50 spending to the content ID read in step F18 is read from 
the schedule managing unit 26, and the decryption unit 
27 decrypts, using the decryption key DK2, the encrypt- 
ed decryption key DK1 read from the delivery card 4. 
[0329] In step F20, using the decrypted decryption 
55 key DK1 , the decryption unit 27 decrypts the additional 
information and the flags read from the delivery card 4. 
[0330] Thereafter, in step F21 , the judgment unit 28 
judges whether the date/time, the delete flag, the settle- 
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ment amount and other information are valid, on the ba- 
sis of the decrypted additional information and flags. 
More specifically, for example, the judgment is made by 
comparing the additional information read from the de- 
livery card 4 with the additional information stored in the 
schedule managing unit 26. The judgment of the settle- 
ment amount is made by asking the bank center 550 
connected to the server 1 about the status of an account 
having a corresponding account number. In the case 
where the value of the deletion-from-playback-appara- 
tus flag is defined such that "1 1 " indicates that the data 
has been deleted, checking of the deletion-from-play- 
back-apparatus flag is performed by determining wheth- 
er its value is equal to "1 1 If the value of the deletion- 
from-playback-apparatus flag is equal to "10", it is de- 
termined that the content data has not been deleted ad- 
equately by the playback apparatus 3. The deletion- 
from-relay-serverflag is also judged in a similar manner. 
[0331 ] I Tine answer lo the judgment is affirmative, the 
process proceeds to step F22. In step F22, an invoice 
is output from the output unit 29. On the other hand, in 
the case where unauthorized use or any trouble is de- 
tected, the process proceeds to step F23. In step F23, 
n demand letter a warning message, or a confirmation 
request message is output from the output unit 29 to the 
ccrresponding destination identifier ID2. The output unit 
29 may print the invoice or the demand letter on a sheet. 
[0332] Alihough in the present embodiment, the in- 
voice or the demand letter is printed on a sheet and the 
pnntcd sheet is sent by mail, the invoice or the demand 
letter may be described in the form of electronic data 
ard may be directly transmitted from the distribution 
controller 13 to the corresponding playback apparatus 
3 

[0333] In the case the judgment reveals that a neces- 
sary amount of money has not been transferred to the 
account the distribution controller 13 may transmit a 
program to the playback apparatus 3 thereby disabling 
the p ayback apparatus 3 and may remotely control the 
operation of the playback apparatus 3 thereafter. 
[0334] Thus, the process associated with the inserted 
delivery card 4 is performed in steps F7 to F23 in the 
above-described manner. 

[0335] In the present embodiment, the judgment con- 
cerning the returned delivery card 4 is performed by the 
server 1. Alternatively, the relay server 2 may perform 
the judgment concerning the returned delivery card 4. 
In this case step F8 and steps F1 8 to F23 are performed 
by the card read/write controller 1 05 and the authenti- 
cation/write controller 1 06 of the relay server 2. 
[0336] In the present embodiment, in addition to the 
outputting of the invoice or the demand letter, the card 
read/write controller 20 may delete all data stored in the 
inserted delivery card 4 so as to invalidate the delivery 
card 4. 

[0337] After completing the above-described process 
in response to insertion of a card, or when no inserted 
card is detected, or when it is determined that it is not 
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time to send the delivery card 4, the process proceeds 
to step F24. In step F24, the distribution controller 13 
determines whether it is time to transmit a content ID 
stored in the storage unit 12. 
5 [0338] If it is determined that there is a content data 
to be transmitted at the present time, the process pro- 
ceeds to step F25. In the case where there is no such 
content data, the process jumps to step F28. 
[0339] The time at which content data is transmitted 
10 js determined such that the time is a predetermined pe- 
riod earlier than the day when the content data is started 
to be played. For example, the content data may be 
transmitted at the same time as the delivery card. Alter- 
natively, because transmission of content data can be 
15 performed in a short time compared with sending of a 
card, content data may be transmitted one week before 
the day when the content data is started to be played. 
[0340] In the case where there is content data to be 
transmitted at the present time, the database controller 
14 retrieves the content data corresponding to the con- 
tent ID which should be transmitted at the present time. 
[0341] Thereafter, in step F26, the retrieved content 
data and the associated additional information which 
have been already encrypted are transferred to the 
modulator 30. The modulator 30 performs PSK modu- 
lation upon the received data. 

[0342] In step F27, the transmitting unit 31 transmits 
the encrypted content and additional information mod- 
ulated in the previous step. 

[0343] Thus, the content data is transmitted to the re- 
lay server 2. 

[0344] Then instep F28 : the controller such as the dis- 
tribution controller 13 determines whether an end com- 
mand has been issued by a human operator. If an end 
command has not been issued, the flow returns to step 
F1 to repeat the above-described process. If an end 
command is detected, the process is ended. 

[G(1)] Process Performed by Relay Server 

[0345] The process performed by the relay sever 2 is 
described below with reference to a flow chart shown in 

Fig. 8. 

[0346] First, in step F31 , it is determined whether the 
receiving unit 101 has received the encrypted content 
data and associated information from the server 1 . If no, 
the process jumps to step F36. If yes, the process pro- 
ceeds to step F32. 

[0347] In the case where the process proceeds to step 
F32 as a result of determination that the encrypted con- 
tent and additional information have been received, the 
demodulator 102 demodulates the received encrypted 
content and additional information. 
[0348] Thereafter, in step F33, the decryption unit 1 03 
reads, via the card read/write controller 1 05, the decryp- 
tion key DK2 generated by the key generator 1 04. Using 
this decryption key DK2, the decryption unit 103 de- 
crypts the decryption key DK1 which has been received 
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and demodulated. 

[0349] Furthermore, using the decrypted decryption 
key DK1, the decryption unit 103 decrypts the content 
data and the additional information. 
[0350] In the next step F34 ? the authentication/write 
controller 106 determines whether the destination iden- 
tifier ID1 described in the additional information is con- 
sistent with the ID of the relay server 2 stored in the relay 
server ID storage unit 1 07. If they are not consistent with 
each other, it is determined that the received data is not 
content data addressed to the relay server 2, and thus 
the process jumps to step F36. 

[0351] In the case where the destination identifier ID1 
and the relay server ID are consistent with each other, 
it is determined that the received data is addressed to 
the relay server 2, and thus the process proceeds to step 
F35. In step F35, the encryption unit 108 determines the 
encryption key AK1 corresponding to the decryption key 
DK1 . Using this encryption key AK1 , the encryption unit 
1 08 re-encrypts the compressed content data and the 
associated additional data which have been received 
and demodulated. The resultant data is stored in the 
compressed data storage unit 109 so that it can be 
transmitted later to the playback apparatus 3. 
[0352] The additional information is also stored in the 
storage unit 110 without being encrypted. 
[0353] The received data is processed in steps F32 
to F35 in the above-described manner. 
[0354] In the present embodiment, the re-encryption 
is performed using the encryption key AK1 correspond- 
ing to the decryption key DK1 . However there is a great- 
er risk that data is stolen when the data is transmitted 
from the relay server 2 to the playback apparatus 3 than 
when the data is transmitted from the server 1 to the 
relay server 2. In view of the above, the encryption unit 
108 may perform re-encryption using a higher-graded 
encryption key than the encryption key AK1 . For exam- 
ple, an encryption key having a greater number of bits 
may be employed. 

[0355] When the receiving process described above 
is completed, or when no data is received, the process 
proceeds to step F36. In step F36, the card read/write 
controller 105 determines whether a delivery card 4 is 
inserted in the card interface 111 . 
[0356] If it is determined that a delivery card 4 is in- 
serted, the process proceeds to step F37. However, 
when no inserted card is detected, the process jumps 
to step F41 . 

[0357] In the case where the process has proceeded 
to step F37 as a result of determination that a delivery 
card 4 is inserted, the card read/write controller 105 
reads the encrypted decryption key DK1 and additional 
information from the delivery card 4. In steps F38 and 
F39, the encrypted decryption key DK1 and additional 
information are decrypted. More specifically, the decryp- 
tion unit 1 03 decrypts the decryption key DK1 , by using 
the decryption key DK2 generated by the key generator 
104, and further decrypts the additional information by 



using the decrypted decryption key DK1 . 
[0358] In the case where the delivery card 4 has been 
inserted for the first time, the storage area for the dele- 
tion-from-relay-server flag has a value of "GO". In this 

5 case, "10" is written as the deletion-from-relay-server 
flag so as to indicate that the content data associated 
with this delivery card 4 is stored in the relay server 2 
and also indicate that the delivery card 4 has been in- 
serted in the relay server 2 at least once. 

10 [0359] Thereafter, in step F40, the authentication/ 
write controller 1 06 determines whether the information 
read from the delivery card 4 includes a deletion-from- 
playback-apparatus flag. 

[0360] In the case where there is no deletion-from- 

f5 playback-apparatus flag (that is, in the case where the 
storage area for the deletion-from-playback-apparatus 
flag has a value of "OO"), the delivery card 4 is deter- 
mined as having been sent from the server 1 . In the case 
where there is a deletion-from-playback-apparatus flag 

20 (that is, in the case where the storage area for the de- 
letion-from-playback-apparatus flag has a value of "10" 
or "11"), the delivery card 4 is determined as having 
been returned from the playback apparatus 3. 
[0361] In the case where the inserted delivery card 4 

25 is one sent from the server 1 , the process proceeds to 
step F41 . In step F41 , the distribution controller 112 de- 
termines whether the content IDs stored in the storage 
unit 110 include one which corresponds to content data 
which should be transmitted at the present time. 

30 [0362] If such a content ID is detected, the process 
proceeds to step F42. However, such a content ID is not 
detected, the process jumps to step F49. 
[0363] In the case where a content ID is detected 
which corresponds to content data which should be 

35 transmitted at the present time, the process proceeds 
to step F42. In step F42, under the control of the distri- 
bution controller 112, the database controller 113 re- 
trieves the content data to be transmitted from the com- 
pressed data storage unit 109. 

40 [0364] Thereafter, in step F43, the retrieved encrypt- 
ed content data and associated additional information 
are modulated by the modulator 1 1 4 and transmitted, in 
the next step F44, from the transmitting unit 115 to the 
playback apparatus 3. 

45 [0365] Thus, the content data and the additional infor- 
mation are transmitted to the playback apparatus 3 of 
each movie theater 502. 

[0366] In the case where it is determined in step F40 
that the deletion-from-playback-apparatus flag stored in 

50 the inserted delivery card 4 has a value of "1 0" or "1 1 ", 
the delivery card 4 is determined to be one which has 
been returned after the expiration of the playing period 
during which the corresponding content data was per- 
mitted to be played back by the playback apparatus 3. 

55 [0367] Thereafter, in step F45, the authentication/ 
write controller 1 06 starts to delete the compressed con- 
tent data corresponding to that delivery card 4 from the 
compressed data storage unit 109. That is, the content 
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data, which was transmitted to the playback apparatus 
3 in the past and the playing period of which has expired, 
is deleted from the relay server 2. Normally, this content 
data has already been deleted from the playback appa- 
ratus 3, and thus the deletion-from-playback-apparatus 
flag has a value of "11". 

[0368] In step F46, the authentication/write controller 
1 06 determines whether the deleting process has been 
properly performed. If yes, the process proceeds to step 
F47. However if the deleting process has been ended 
abnormally, the process jumps to step F49. 
[0369] I n the case where the process proceeds to step 
F47 after normal completion of deleting the content da- 
ta, the encryption unit 1 1 6 re-encrypts, under the control 
of the authentication/write controller 106, the deletion- 
from-relay-serverflag having a value of "11" indicating 
that the content data has been deleted, as well as the 
associated additional information, using the encryption 
key AK1 . In step F48, the card read/write controller 1 05 
writes the re-encrypted data into the inserted delivery 
card 4 via the card interface 111 . Thus, the flag and the 
additional information written in the returned delivery 
card 4 is rewritten. 

[0370] As described earlier, it is required that the serv- 
er 1 can read the content ID from the returned delivery 
card 4 without having to use the decryption key. To this 
end, in the process performed in steps F47 and F48, the 
content ID is not encrypted while the other data of the 
additional information is encrypted. 
[0371] After completion of the rewriting, the delivery 
card 4 is sent to the server 1 and subjected to the above- 
described process in steps F1 8 to F23 in Fig. 7. 
[0372] In step F49, a controller such as the authenti- 
cation/write controller 106 determines whether an end 
command has been issued by a human operator. If the 
end command is detected, the process is ended. How- 
ever, if the end command is not detected, the flow re- 
turns to step F31 to repeat the above-described proc- 
ess. 

[H(1)] Process Performed by Playback Apparatus 

[0373] The process performed by the playback appa- 
ratus 3 described below with reference to a flow chart 
shown in Fig. 9. 

[0374] First, in step F51 , it is determined whether an 
encrypted content data and associated additional infor- 
mation transmitted from the relay server 2 have been 
received by the receiving unit 201 . If content data and 
associated additional information have been received, 
the process proceeds to step F52. However, when no 
data has been received, the process jumps to step F56. 
[0375] In the case wherethe process proceeds to step 
F52 after receiving the data, the demodulator 202 de- 
modulates the received encrypted content data and as- 
sociated additional information. 

[0376] Thereafter in step F53, the decryption unit 203 
reads, via the card read/write controller205, thedecryp- 
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tion key DK2 generated by the key generator 204 and 
decrypts the received and demodulated decryption key 
DK1 using the decryption key DK2. 
[0377] Furthermore, using the decrypted decryption 

5 key DK1 , the decryption unit 103 decrypts the content 
data and the additional information. 
[0378] Thereafter, in step F54, the authentication/ 
write/delete controller 206 determines whether the des- 
tination identifier ID2 described in the additional infor- 

10 mation is consistent with the playback apparatus ID 
stored in the playback apparatus ID storage unit 207. If 
they are not consistent with each other, it is determined 
that the received data is not addressed to the playback 
apparatus 3, and the process jumps to step F56. 

15 [0379] On the other hand, in the case where the des- 
tination identifier ID2 is consistent with the playback ap- 
paratus ID and thus the received data is addressed to 
the playback apparatus 3, the process proceeds to step 
F55. In step F55, the compressed content data and the 

20 associated additional information, which have been re- 
ceived, demodulated and decrypted, are stored as play- 
back data in the compressed data storage unit 208 such 
that the content data and the additional information are 
related to each other. 

25 [0380] The additional information is also stored in the 
storage unit 209. 

[0381] The received data is processed in steps F52 
to F55 in the above-described manner. 
[0382] In step F56, it is determined whether a play- 
so back command has been issued by a human operator 
via the user control unit 210. If yes, the process pro- 
ceeds to step F57. 

[0383] In step F57, the card read/write controller 205 
determines, via the card interface 211 , whether a deliv- 

35 ery card 4 is inserted. If no inserted card is detected, the 
process proceeds to step F58. In step F58, detection 
information indicating that no inserted delivery card is 
detected is applied to the authentication/write/delete 
controller 206 via the decryption unit 203. In response, 

40 the authentication/write/delete controller 206 controls 
the display controller 212 to display a warning on the 
display unit 21 3. Thereafter, the process returns to step 
F57. Thus, in the playback process, the human operator 
is requested to insert the delivery card 4. 

45 [0384] In the case where it is determined in step F57 
that a delivery card 4 is inserted, the process proceeds 
to step F59. In step F59, the card read/write controller 
205 reads the encrypted decryption key DK1 and addi- 
tional information from the delivery card 4. 

so [0385] In step F60, the decryption key DK1 is decrypt- 
ed using the decryption key DK2 generated by the key 
generator 204. In step F61 , the additional information is 
decrypted using the decryption key DK1 . 
[0386] In the case where the delivery card 4 is one 

55 which has been inserted for the first time, the storage 
area for the detetion-f rom-playback-apparatus flag has 
a value of "00". In this case, "1 0" is written into the de- 
letion-from-playback-apparatus flag so as to indicate 
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that the content data associated with this delivery card 
4 is stored in the playback apparatus 3 and also indicate 
that the delivery card 4 has been inserted in the play- 
back apparatus 3 at least once. 

[0387] In step F62, the authentication/write/delete 
controller 206 determines whether the additional infor- 
mation stored in the storage unit 209 after being re- 
ceived, demodulated and decrypted is consistent with 
the additional information decrypted after being read 
from the delivery card 4. If they are consistent with each 
other, it is further determined whether the present time 
is within the playing period indicated by the schedule 
information described in the additional information. 
[0388] If it is determined that the present time is within 
the playing period, the process proceeds to step F64. 
However, if inconsistency regarding the additional infor- 
mation is detected, or if the present time is not within 
the playing period although the consistency is obtained, 
the content data is not allowed to be played back in ac- 
cordance with the contract, and thus the process pro- 
ceeds to step F63. In step F63, as in step F58, a warning 
is displayed on the display 213. The process then pro- 
ceeds to step F75. 

[0389] In the case where tho process has proceeded 
to slop F64 as a result of determination that the addi- 
tional information is valid and the present time is within 
tho playing period, the database controller 215 re- 
trieves under the control of the playback controller 21 4, 
the coment data to be played back, from the com- 
pressed data storage unit 208. 

[0390] Then in step F65. the playback controller 214 
issues a command to play back the compressed content 
d«M stored in the compressed data storage unit 208 via 
the database controller 215. The compressed content 
drtta ts road from the compressed data storage unit 208 
ard transmitted to the data separating unit 21 6. The da- 
ta separating unit 21 6 separates the received content 
data into audio and video data. The audio and video data 
are decompressed by the decompressing unit 21 7 and 
then converted by the D/A converter 218 into analog 
fomi Finally, the playback unit 219 generates a sound/ 
voice and an image in accordance with the analog audio 
and video data. 

[0391] in step F66, the playback controller 214 mon- 
itors whether the playing-back operation is completed. 
If the playmg-back of the content data of the movie is 
completed, the process proceeds to step F67. 
[0392] As described above, when a human operator 
issues a playback command, the process from step F56 
to step F66 is performed by the playback apparatus 3 
to play a movie one time. 

[0393] In the case where the playback command from 
the user control unit 210 is not detected is step F56, or 
in the case where completion of the playing-back oper- 
ation is detected in step F66, the process proceeds to 
step F67. In step F67, it is determined whether a content 
delete command has been issued from the user control 
unit 21 0. If the content delete command is detected, the 



process proceeds to step F68. However, the content de- 
lete command is not detected, the process jumps to step 
F72. 

[0394] The content data is deleted, in response to a 

5 demand issued by the movie production company 500 
or the movie distribution company 501 , from the com- 
pressed data storage unit 208 after the end of the al- 
lowed playing period thereby protecting the copyright of 
the content data. 

10 [0395] That is : when the playing period of a movie 
content has expired, the operator of the playback appa- 
ratus 3 has to delete the movie content at an arbitrary 
time (within a predetermined period) afterthe end of the 
allowed playing period in response to the content delete 

15 command detected in step F67. 

[0396] In the case where the process has proceeded 
to step F68 in response to detecting the content delete 
command, compressed content data corresponding to 
a content ID specified by the operator is started to be 

20 deleted from the compressed data storage unit 208, un- 
derthe control of the authentication/write/delete control- 
ler 206. 

[0397] In step F69, the authentication/write/delete 
controller 206 monitors whether the specified content 

25 data has been deleted successfully. If the deleting has 
been completed successfully, the process proceeds to 
step F70. However, the deleting is not completed suc- 
cessfully, the process jumps to step F72. . 
[0398] When the process has proceeded to step F70 

30 afterthe content data has been deleted successfully, the 
encryption unit 220 re-encrypts, under the control of the 
authentication/write/delete controller 206, the deletion- 
from-playback-apparatus flag, now having a value of 
"11 " which indicates that the content data has been de- 

35 leted, together with the corresponding additional infor- 
mation, using the encryption key AK1 . In step F71 , the 
re-encrypted data is written into the inserted delivery 
card 4 via the card read/write controller 205 and the card 
interface 21 1 . Thus, the flag and the additional informa- 

40 tion are rewritten into the delivery card 4 which will be 
returned later. 

[0399] As described earlier, it is required that when 
the delivery card 4 is returned to the relay server 2, the 
relay server 2 can read the content ID from the delivery 
45 card 4 without having to use the decryption key. For this 
purpose, of various data described in the additional in- 
formation, the content ID is not encrypted in steps F70 
and F71 . 

[0400] Writing the playback apparatus flag so as to 
50 have a value of "1 1 " allows the relay server 2 or the serv- 
er 1 to recognize that the playback apparatus 3 has ad- 
equately deleted the content data. 
[0401] The movie theater 502 has to pay a predeter- 
mined fee to the movie distribution company 501 or the 
55 movie production company 500 in accordance with the 
delivery contract 

[0402] To this end, at an arbitrary time, the operator 
of the playback apparatus 3 performs an operation to 
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pay the fee. 

[0403] In step F72, the charge controller 221 deter- 
mines whether a pay command has been issued from 
the user control unit 210. If the pay command is detect- 
ed, the process proceeds to step F73. However, if the 5 
pay command is not detected, the process jumps to step 
F75. 

[0404] When the process has proceeded to step F73 
in response to the pay command, the charge controller 
221 transmits a pay request message to the bank center 10 
550 to request the bank center 550 to pay the fee to the 
relay server 2 or the server 1 . In response to the pay 
request message, the bank center 550 transfers a spec- 
ified amount of money to the account of the relay server 
2 or the server 1 . Thus, the fee has been paid from the 15 
movie theater 502 to the relay server 2 or the server 1 . 
[0405] After transmitting the pay request message, 
the charge controller 221 waits for a response message 
from the bank center 522. If a response message ar- 
rives, the charge controller 221 determines whether the 20 
payment has been properly performed. If it is deter- 
mined that the payment has been properly performed, 
the charge controller 221 informs the authentication/ 
write/delete controller 206 that the payment has been 
properly performed. 25 
[0406] In response to the completion of the payment, 
the authentication/write/delete controller 206 sets the 
settlement completion flag and writes it into inserted de- 
livery card 4 via the card read/write controller 205 and 
the card interface 21 1 after encrypting it via the encryp- 30 
tion unit 220. 

[0407] As described above, when the content data 
has been deleted or when the payment has been per- 
formed, the deletion-from-playback-apparatus flag or 
the settlement completion flag is written into the delivery 35 
card 4 in steps F67 to F74. 

[0408] The delivery card 4 into which the flags have 
been written is sent to the relay server 2 and subjected 
to the above-described process in step F45 to step F48. 
[0409] In step F75, a controller such as the authenti- 40 
cation/write/delete controller 206 determines whether 
an end command has been issued from the user control 
unit 210. If the end command is detected, the process 
is ended. However, if the end command is not detected, 
the flow returns to step F51 to repeat the above-de- 45 
scribed process. 

[1(1)] Advantages 

[0410] The configuration and the operation according 50 
to the first embodiment of the invention have the follow- 
ing advantages. 

(1) Because a movie image source is supplied not 
in the form of a film but in the form of content data, 55 
a reduction in delivery cost and an improvement in 
delivery efficiency are achieved. 

Because the content data is transmitted in ac- 
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cordance with the schedule information, the trans- 
mission can be easily managed and controlled. 

(2) Because the content data is transmitted after be- 
ing encrypted, high security is ensured and the cop- 
yright is protected. 

(3) The decryption key DK1 used in decrypting the 
encrypted content data and associated additional 
information is not transmitted together with the con- 
tent data, but it is supplied via a delivery card 4 
which is sent separately from the content data. 

The decryption key DK1 is written in the deliv- 
ery card 4 after being encrypted using the encryp- 
tion key AK2. 

This secures the copyright in a more reliable 
fashion. 

(4) The playback apparatus 3 cannot deal with the 
received content data and the associated additional 
information unless the delivery card 4 is inserted. 

More specifically, the content data cannot be 
played back unless the delivery card 4 is inserted. 
Furthermore, to play back the content data, the ad- 
ditional information described in the delivery card 4 
is needed to be valid, and the content data is al- 
lowed to be played back only during a playing period 
indicated by the schedule information. 

This ensures that the content data can be 
played back only by an authorized playback appa- 
ratus and only during an authorized period. That is, 
the playback apparatus 3 cannot use the content 
data in an unauthorized fashion. 

(5) After expiration of the playing period, only the 
delivery card 4 is returned, and the content data 
stored in the playback apparatus 3 orthe relay serv- 
er 2 is deleted. 

This allows a reduction in cost compared with 
the conventional system which needs high cost to 
collect films. 

(6) When the content data is deleted from the play- 
back apparatus 3 orthe relay server 2, a delete flag 
having a value of "1 1 " is written into the delivery card 
4. If the content data is not deleted, the delete flag 
has a value of "10". Thus, it is possible to determine 
whether the content data has been deleted from the 
playback apparatus 3 orthe relay server2 by check- 
ing whether the value of the delete flag is equal to 
"11 " or "1 0". This makes it possible to easily manage 
and control the distributed content data so as to pre- 
vent the content data from being used in an unau- 
thorized manner. 

(7) When the payment operation has been per- 
formed by the playback apparatus 3, the settlement 
completion flag is written in the delivery card 4. The 
server 1 can determine whether the playback appa- 
ratus 3 (movie theater 502) has correctly made pay- 
ment by checking the value of the settlement com- 
pletion flag written in the delivery card 4 returned to 
the server 1 . This ensures that charging and pay- 
ment are easily performed and managed in the 
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movie distribution system. 

(8) By checking the validity of the destination iden- 
tifier ID1 or ID2, it is possible to transmit the content 
data only to an authorized relay server 2 or an au- 
thorized playback apparatus 3. 

In other words, it is possible for the movie pro- 
duction company 500 to easily control the distribu- 
tion of the content data so that the content data is 
supplied only to specified playback apparatuses 3 
or movie theaters 502 but not to undesirable play- 
back apparatuses 3 or movie theaters 502. 

Second Embodiment 



[A(2)J Outline 

[0411] The outline of a movie distribution system ac- 
cording to a second embodiment of the present inven- 
tion is described below with reference to Fig. 10. 
[0412] Fig. 10 is a diagram similar to Fig. 2 and illus- 
trates flows of content data 6 and storage medium (de- 
livery card 4) transmitted or transported among a server 
1 installed in a movie production company 500, relay 
server 2 installed in a movie distribution company 501 , 
and a playback apparatus 3 installed in a movie theater 
502. 

[0413] In this second embodiment, the server 1 does 
not distribute content data by means of transmission but 
the server 1 delivers a movie film 5, which has been ed- 
ited after being shot, to the respective movie distribution 
companies 501. 

[0414] As in the first embodiment, the server 1 pro- 
duces as many delivery cards 4 as required, and the 
server 1 sends the delivery cards 4 to the respective 
movie distribution companies 501 in parallel with or to- 
gether with the films 5. 

[0415] In each movie distribution company 501 , a re- 
lay server 2 receives a film 5 and a delivery card 4 sent 
from the server 1. The movie recorded on the film 5 is 
converted into the form of content data 6 so that it can 
be transmitted. 

[0416] The relay server 2 then transmits the encrypt- 
ed content data 6 and additional information to each 
theater movie 502 and also sends one distribution card 
4 to each movie theater 502. 

[0417] The playback apparatus 3 in each movie theat- 
er 502 receives the content data 6 and the associated 
additional information. The playback apparatus 3 also 
reads various kinds of information such as the additional 
information stored on the received distribution card 4. 
Using a key read from the delivery card 4, the playback 
apparatus 3 decrypts the encrypted content data and 
additional information, and plays back the content data 
6 in accordance with the additional information read 
from the delivery card 4 and the additional information 
received via electronic transmission. 
[041 8] In each movie theater 502, when the predeter- 
mined playing period has expired, the content data 6 



stored in the playback apparatus 3 is deleted. Further- 
more, a delete flag in the delivery card 4 is set to "11" 
so as to indicate that the content data 6 has been delet- 
ed. 

5 [0419] Thereafter, the delivery cards 4 are returned to 
the movie distribution companies 501. The delivery 
cards 4 are then returned to the movie production com- 
pany 500. 

[0420] On the basis of the information stored on the 
10 collected delivery cards 4, the server 1 checks whether 
the distributed content data 6 has been used adequate- 
ly. More specifically, for example, the server 1 checks 
whether the movie was played only during the period 
allowed by the contract and whether the content data 6 
15 has been correctly deleted after the expiration of the 
playing period. 

[B(2)] Configuration of Server 

20 [0421] The configuration of the server 1 is described 
below with reference to Fig. 11 . 

[0422] As shown in Fig. 11 , the server 1 includes, as 
in the first embodiment (Fig. 3), a distribution managing 
unit 1 B, a copyright managing unit 1 C s a return manag- 
es ing unit 1 D, and a card controller 1 E. 

[0423] However, in this second embodiment, the serv- 
er 1 does not include the film scanner 1 A, the compres- 
sion coder 19, and the movie database 16 which are 
included in the server 1 shown in Fig. 3, because the 
30 server 1 sends a movie source in the form of a film 5 to 
the relay servers 2. 

[0424] For the same reason, the distribution manag- 
ing unit 1 B does not include the modulator 30, the trans- 
mitting unit 31 , and the database controller 14 shown in 
35 Fig. 3. 

[0425] Because the server 1 deals with the movie 
source in the form of film 5, an encryption unit 22 of the 
copyright managing unit 1C decrypts only additional in- 
formation. That is, additional information stored in astor- 
40 age unit 12 is supplied to the encryption unit 22 under 
the control of the distribution controller 13, and the en- 
cryption unit 22 encrypts the received additional infor- 
mation. 

[0426] The encrypted additional information is written 
45 into a delivery card 4 under the control of the card con- 
troller 1E. 

[0427] The other parts shown in Fig. 11 are similar to 
those of the first embodiment, and thus they are not de- 
scribed herein in further detail. 

50 

[C(2)] Configuration of Card 

[0428] The delivery card 4 is*constructed in a similar 
manner to that shown in Fig. 4. The delivery card 4 is 
55 produced by the server 1 by writing additional informa- 
tion and other information into the memory 43 provided 
in the delivery card 4. The information written in the de- 
livery card 4 includes, as shown in Fig. 4, a decryption 
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key DK1 encrypted using an encryption key AK2 and 
additional information such as a content ID, destination 
identifiers ID1 and ID2, and schedule information. 

fD(2)] Configuration of Relay Server 5 

[0429] Fig. 12 illustrates a configuration of the relay 
server 2. 

[0430] In this second embodiment, as described ear- 
lier with reference to Fig. 10, the relay server 2 converts 10 
the movie recorded on the film 5 into the content data 6. 
[0431] For the above purpose, the relay server 2 in- 
cludes, in addition to those shown in Fig. 5, a film scan- 
ner 2a, a compression coder 118, and an input unit 117, 
as shown in Fig. 12. 15 
[0432] The other parts and their operations are similar 
to those described earlier with reference to Fig. 5. How- 
ever, it is not needed to receive content data from the 
server 1, and thus the relay server 2 does not include 
the receiving unit 101 and demodulator 102 shown in 20 
Fig. 5 (a receiving unit and a demodulator may be pro- 
vided to achieve a capability of transmitting and receiv- 
ing general data via the transmission line 7, but they are 
not necessary to receive content data). 
[0433] The film scanner 2a converts a movie film 5 25 
received from the server 1 into the form of data so as to 
be able to be transmitted. To this end, the film scanner 
2a includes a digital video reading unit 1 21 for scanning 
an image formed on the film 5 and converting it into dig- 
ital video data and also includes a digital audio reading 30 
unit 120 for converting a sound track signal recorded on 
the film 5 into an audio signal and outputting the result- 
ant signal. 

[0434] The digital video data and the digital audio data 
read from the movie film 5 are supplied to a compression 35 
coder 1 1 8 and converted into content data in a prede- 
termined format. More specifically, the compression 
coder 118 converts the input digital video data and dig- 
ital audio data into compressed content data, for exam- 
ple, according to the MPEG standard. Note that there is 40 
no particular restriction on the format of the content data, 
and formats other than the MPEG format, such as the 
AVI format or the Window Media Technology format, 
may also be employed. 

[0435] The advantage obtained by compressing the 45 
data is that the amount of data to be transmitted can be 
reduced. However, the content data is not necessarily 
required to be compressed, as long as the content data 
can be used to play back a movie. 

[0436] The content data generated by the compres- so 
sion coder 118 is supplied to the authentication/write 
controller 1 06 and written into the compressed data stor- 
age unit 1 09 underthe control of the authentication/write 
controller 106. Thus, the content data generated from 
the film 5 is stored in the relay server 2. 55 
[0437] The input unit 1 1 7 is used by a human operator 
to input a scan command to control the film scanner 2a 
and to input a command to input additional information. 



[0438] Additional information which is input via the in- 
put unit 117 when the film is scanned is stored in the 
storage unit 110 underthe control of the authentication/ 
write controller 106. 

[0439] When the delivery card 4 corresponding to the 
film 5 is received from the server 1 and inserted into the 
relay sever 2, the write/write controller 106 checks 
whether the additional information stored in the delivery 
card 4 is consistent with the additional information 
stored in the storage unit 11 0. If they are consistent with 
each other, the generated content data is stored togeth- 
er with the additional information, as information for use 
of distribution, into the compressed data storage unit 
109. 

[0440] More specifically, in the above process, the 
content data and the associated additional information 
stored in the compressed data storage unit 109 are en- 
crypted by the encryption unit 1 08 and rewritten into the 
compressed data storage unit 109 underthe control of 
the authentication/write controller 106. That is, the en- 
crypted content data and associated additional informa- 
tion are stored in the compressed data storage unit 1 09 
so that they can be distributed to the movie theaters 502 . 
[0441] In the above encryption process performed by 
the encryption unit 1 08, the encryption key AK1 is used. 
To this end, as in the first embodiment, there is provided 
a key generator for generating the same encryption key 
AK1 as that generated by the key generator 23 of the 
server 1 , although the key generator is not shown in the 
figure. Alternatively, the encrypted decryption key DK1 
is read from the delivery card 4 and decrypted using the 
decryption key DK2, and then the encryption key AK1 
is generated from the decryption key DK1 . 

[E(2)] Configuration of Playback Apparatus 

[0442] The playback apparatus 3 according to the 
second embodiment has a similar configuration to the 
playback apparatus 3 according to the first embodiment 
(Hg. 6). 

[F(2)] Process Performed by Server 

[0443] The process performed by the server 1 is de- 
scribed below with reference to a flow chart shown in 
Fig. 13. 

[0444] In step F1 01 , it is determined whether a human 
operator of the server 1 has input, via the input unit 11 , 
a content ID, a destination identifier ID1 , a destination 
identifier ID2, and schedule information associated with 
a movie content. If yes, the process proceeds to step 
F102. However, if it is determined in step F101 that no 
information has been input, the process jumps to step 
F103. 

[0445] In step F1 02, the information input via the input 
unit 1 1 , that is, the additional information, is stored in the 
storage unit 12. 

[0446] When the above process in step F102 started 
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in response to the command input by the operator is 
completed, or when no operation is performed by the 
operator the card read/write controller 20 determines in 
step F1 03 whether the delivery card 4 is inserted via the 
card interface 21 . 

[0447] If it is determined that the delivery card 4 is in- 
serted, the process proceeds to step F104. However, 
no inserted delivery card is detected, the process jumps 
to step F119. 

[0448] When the process has proceeded to step F1 04 
as a result of determination that the delivery card 4 is 
inserted, the card read/write controller 20 reads the in- 
formation stored in the delivery card 4 and determines 
whether the inserted delivery card 4 is a new card. Here- 
in, the "new card" refers to a blank card in which no in- 
formation such as additional information or a decryption 
key DK1 has not yet been written and which is inserted 
to produce a delivery card 4 to be sent to a relay server 2. 
[0449] In the case where the inserted delivery card 4 
is one which has been returned from a movie distribution 
company 501 (or a movie theater 502), it is determined 
that the delivery card 4 is not a new card. 
[0450] If the inserted delivery card 4 is determined as 
a new card, the process proceeds to step F105. How- 
ever, the inserted delivery card 4 is determined as a re- 
turned card, the process jumps to step F113. 
[0451] In the case where the process has proceeded 
to step F9 as a result of the determination that the de- 
livery card 4 is a new card, the distribution controller 13 
determines whether it is time to send the delivery card. 
[0452] More specifically, it is determined whether it is 
time to send the delivery card on the basis of the sched- 
ule information associated with the content data stored 
in the storage unit 1 2. If it is determined that it is time to 
send the delivery card 4, the process proceeds to step 
F106. However, if it is determined that it is not time to 
send the delivery card 4, the process jumps to step 
F119. 

[0453] In the case where the process has proceeded 
to step F1 06 after determining that it is time to send the 
delivery card 4, the additional information including the 
schedule information is transferred to the encryption unit 
22. 

[0454] In the next step F107, the encryption unit 22 
encrypts the received additional information using the 
encryption key AK1 generated by the key generator 23. 
[0455] In step F108, the additional information en- 
crypted using the encryption key AK1 is stored. The en- 
crypted additional information may be stored in the stor- 
age unit 12, or may be stored in an internal memory of 
the encryption unit 22 if the encryption unit 22 has the 
internal memory. Alternatively, the encrypted additional 
information may be stored in a storage unit such as a 
hard disk. 

[0456] In step F109, the additional information en- 
crypted using the encryption key AK1 is supplied to the 
card read/write controller 20 and written into the inserted 
new card via the card interface 21 . 
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[0457] In step F110, using the encryption key AK2 
generated by the key generator 24, the encryption unit 
25 encrypts the decryption key DK1 generated by the 
encryption unit 23. In step F111 , the decryption key DK1 

5 encrypted using the encryption key AK2 is supplied to 
the card read/write controller 20 and written into the in- 
serted new card via the card interface 21 . 
[0458] Thus, in the above process, the encrypted de- 
cryption key DK1 and the encrypted additional informa- 

10 tion have been written into the inserted new card thereby 
producing a delivery card 4 such as that shown in Fig. 
4, which will be sent to a relay server 2 or a playback 
apparatus 3. 

[0459] "If the production of the delivery card 4 is corn- 
's pieted, the process proceeds to step F112. Instep F112, 
the schedule managing unit 25 stores the decryption key 
DK2 together with the additional information stored in 
the storage unit 12. 

[0460] Although in the present embodiment, the de- 
20 livery card 4 is produced by the server 1 by writing the 
additional information and the decryption key into a new 
card, the delivery card 4 may be produced by the relay 
server 2. In this case, the process from step F106 to 
step F112 shown in Fig. 13 is performed by the relay 
25 server 2. 

[0461 ] In the case where the card read/write controller 
20 determines in step F1 04 that the inserted card is not 
a new card, that is, in the case where the inserted card 
is a delivery card 4 which has been returned from the 
30 relay server 2 or the playback apparatus 3 and in which 
additional information has already been stored, the 
process jumps to step F113. 

[0462] In step F1 1 3, the card read/write controller 20 
reads, from the delivery card, the encrypted decryption 

35 key DK1 , the encrypted additional information, and the 
content ID which was stored in an unencrypted form 
when the delivery card 4 was returned. 
[0463] In step F114, the decryption key DK2 corre- 
sponding to the content ID read from the delivery card 

40 4 is read from the schedule managing unit 26, and the 
decryption unit 27 decrypts the encrypted decryption 
key DK1 read from the delivery card 4. 
[0464] In step F115, using the decrypted decryption 
key DK1 , the decryption unit 27 decrypts the additional 

45 information and the flags read from the delivery card 4. 
[0465] In the next step F116, the judgment unit 28 
judges whether the date/time, the delete flag, and the 
settlement amount are valid, on the basis of the decrypt- 
ed additional information and the flag. For example, the 

50 judgment is performed by comparing the additional in- 
formation read from the delivery card 4 with the addi- 
tional information stored in the schedule managing unit 
.26. The judgment of the settlement amount is made by 
asking the bank center 550 connected to the server 1 

55 about the status of an account having a corresponding 
account number. 

[0466] In the case where the judgment indicates that 
the information is valid, the process proceeds to step 
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F117. In step F117, an invoice is output by the output 
unit 29. On the other hand, if the information is deter- 
mined to be invalid or if some problem is detected, the 
process proceeds to step F1 1 8. In step F11 8, a demand 
letter a warning message, or a confirmation request 
message is output from the output unit 29 to the corre- 
sponding destination identifier ID2. The output unit 29 
may print the invoice or the demand letter on a sheet. 
[0467] In the present embodiment, the invoice or the 
demand note is printed on a sheet and the printed sheet 
is sent by mail. Alternatively, the server 1 may have a 
capability of transmitting data via the transmission line 
7 whereby the invoice or the demand letter may be de- 
scribed in the form of electronic data and may be directly 
transmitted from the distribution controller 1 3 to the cor- 
responding playback apparatus 3. 
[0468] In the case the judgment reveals that a neces- 
sary amount of money has not been transferred to the 
account, a program may be transmitted to the playback 
apparatus 3 thereby disabling the playback apparatus 
3 and the operation of the playback apparatus 3 may be 
remotely controlled thereafter. 

[0469] Thus, the process associated with the inserted 
delivery card 4 is performed in steps F1 03 to F11 8 in the 
above-described manner. 

[0470] In the present embodiment, the judgment con- 
cerning the returned delivery card 4 is performed by the 
server 1. Alternatively, the relay server 2 may perform 
the judgment concerning the returned delivery card 4. 
In this case, step F104 and steps F113 to F118 are per- 
formed by the card read/write controller 1 05 and the au- 
thentication/write controller 1 06 of the relay server 2. 
[0471] In the present embodiment, in addition to the 
outputting of the invoice or the demand letter, the card 
read/write controller 20 may delete all data stored in the 
inserted delivery card 4 so as to invalidate the delivery 
card 4. 

[0472] In step F119, the controller such as the distri- 
bution controller 13 determines whether an end com- 
mand has been issued by a human operator. If an end 
command has not been issued, the flow returns to step 
F1 to repeat the above-described process. If an end 
command is detected, the process is ended. 

[G(2)] Process Performed by Relay Server 

[0473] The process performed by the relay sever 2 is 
described below with reference to a flow chart shown in 
Fig. 14. 

[0474] In step F121 , it is determined whether a play- 
back command has been issued by a human operator 
of the relay server 1 via the input unit 117. Herein, the 
playback command refers to a command to play back 
the film 5 mounted on the film scanner 2a in order to 
generate content data of a movie source. In this proc- 
ess, the operator also inputs additional information con- 
cerning the film 5 via the input unit 117. 
[0475] If the playback command to play back the film 



5 which has been mounted on the film scanner 2a after 
being received from the server 1 is detected, and if the 
content ID. the destination identifier ID2, and the sched- 
ule information associated with the movie content have 
5 been input, the process proceeds to step F122. If the 
command or the data is not input, the process jumps to 
step F126. 

[0476] As described earlier, the content ID is an iden- 
tifier uniquely assigned to a movie content. The desti- 

10 nation identifier ID2 corresponds to the playback appa- 
ratus ID of the playback apparatus 3 of the movie theater 
502 to which the content data will be finally sent. On the 
other hand, the destination identifier ID1 is an identifier 
of the relay server 2 itself. Because the destination iden- 

15 tifier ID1 is stored in the relay server ID storage unit 1 07, 
it is not required to input it via the input unit 117. 
[0477] The schedule information has a value such as 
"2000.01.01-2000.04.30" indicating a playing period 
during which the movie is permitted to be played by the 

20 movie theater 502 in accordance with a contract. 

[0478] In step F122, the various kinds of data of the 
additional information input via the input unit 1 1 7 are en- 
crypted by the encryption unit 108 and stored into the 
compressed data storage unit 1 09, under the control of 

25 the authentication/write controller 106. 

[0479] In the next step F123, the authentication/write 
controller 106 issues a command to write the content 
data into the compressed data storage unit 1 09 and then 
starts the operation of the film scanner 2a. 

30 [0480] In response, in step F124, the digital audio 
reader 1 20 of the film scanner 2a reads digital audio da- 
ta from the film 5 and the digital video reader 121 reads 
digital video data therefrom. The obtained digital audio 
and video data are transmitted to the compression coder 

35 118. 

[0481] In step F125, the compression encoder 118 
compresses the digital audio data and the digital video 
data according to, for example, the MPEG "standard 
thereby producing content data in the MPEG format. 

40 [0482] The compressed content data generated by 
the compression coder 118 is written into the com- 
pressed data storage unit 109 under the control of the 
authentication/write controller 106. Note that at this 
stage the compressed content data stored in the com- 

45 pressed data storage unit 1 09 has not yet been encrypt- 
ed by the encryption unit 108. 

[0483] The additional information input via the input 
unit 117 in step F121 is stored in the storage unit 110. 
[0484] As described above, by performing the above- 

50 described process after receiving the film 5 from the 
server, the content data is generated from the from 5. 
[0485] When the above process is completed, or 
when no file playback command is not detected, the 
process goes to step F126. In step F126, the card read/ 

55 write controller 1 05 determines whether a delivery card 
4 is inserted in the card interface 111 . 
[0486] If it is determined that an inserted delivery card 
4 is detected, the process proceeds to step F127. How- 
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ever, when no inserted card is detected, the process 
jumps to step F134. 

[0487] In the case where the process has proceeded 
to step F1 27 after determining that an inserted delivery 
card 4 is detected, the card read/write controller 105 
read the encrypted decryption key DK1 and the encrypt- 
ed additional information from the delivery card 4. In 
step F128, the decryption key DK1 is decrypted. More 
specifically, the decryption unit 1 03 decrypts the decryp- 
tion key DK1 using the decryption key DK2 generated 
by the key generator 1 04. 

[0488] In step F129, using the decrypted decryption 
key DK1 , the decryption unit 1 03 decrypts the additional 
information. Thereafter, using for example the content 
ID as a retrieval key, the authentication/write controller 
106 retrieves additional information stored in the stor- 
age unit 110 to judge whether there is stored additional 
information which is identical to the additional informa- 
tion read from the delivery card 4. 
[0489] If identical additional information is not found, 
it is determined that the currently inserted delivery card 
4 is not one associated with content data existing at this 
point of time in the compressed data storage unit 109, 
that is, it is determined that the delivery card 4 is not one 
associated with content data which is to be transmitted 
or was transmitted in the past to the movie theaters 502. 
In this case, the process proceeds to step F142 without 
doing anything. 

[0490] In the case where identical addition informa- 
tion is found, the process proceeds to step F1 30. In step 
F130, the authentication/write controller 106 judges 
whether the information read from the delivery card 4 
includes a deletion-from-playback-apparatus flag. 
[0491] If there is no deletion-from-playback-appara- 
tus flag (if the deietion-from-playback-apparatus flag = 
"00"). it is determined that the delivery card 4 is one re- 
ceived from the server 1 . In the case where a playback 
apparatus flag is found (if the deletion-from-playback- 
apparatus flag = "10" or "11"), it is determined that the 
delivery card 4 is one returned from the playback appa- 
ratus 3. 

[0492] In the case where the inserted delivery card 4 
is one sent from the server 1 , the process proceeds to 
step F131 . In step F131, an encryption key AK1 corre- 
sponding to the decryption key DK1 is produced from 
the decrypted decryption key DK1 . 
[0493] I n step F1 32, using the encryption key AK1 , the 
encryption unit 108 encrypts the content data and the 
additional information, under the control of the authen- 
tication/write controller 106. Then in step F133, the re- 
sultant encrypted content data and additional informa- 
tion are stored in the compressed data storage unit 1 09. 
[0494] That is, the unencrypted content data, which 
has been stored in the compressed data storage unit 
109 after being produced from the film 5, is encrypted 
using the encryption key AK1 and is stored as content 
data for distribution in the compressed data storage unit 
109. Similarly, the unencrypted additional information 



stored in the storage unit 11 0 is encrypted and stored in 
the compressed data storage unit 1 09 such that the it is 
linked to the corresponding encrypted content data. 
[0495] Thus, the content data and the associated ad- 
5 ditional information to be transmitted to the movie theat- 
ers 502 are stored in the encrypted form in the com- 
pressed data storage unit 1 09. 

[0496] In step F1 34, the distribution controller 1 1 2 de- 
termines whether the content IDs stored in the storage 
10 unit 1 1 0 include one which should be transmitted at the 
present time. 

[0497] If such a content ID is detected, the process 
proceeds to step F135. However, such a content ID is 
not detected, the process jumps to step F142. 
[0498] In the case where a content ID is detected 
which corresponds to content data which should be 
transmitted at the present time, the process proceeds 
to step F135. In step F135, the database controller 113 
retrieves, under the control of the distribution controller 
112, the content data to be transmitted from the com- 
pressed data stored unit 1 09. 

[0499] In step F136, the retrieved encrypted content 
and associated additional information are modulated by 
the modulator 114 and transmitted, in the next step 
25 F1 37, from the transmitting unit 1 1 5 to the playback ap- 
paratus 3. 

[0500] Thus, the content data and the additional infor- 
mation are distributed to the playback apparatus 3 of 
each movie theater 502. 

[0501] In the case where it is determined in step F130 
that the inserted delivery card 4 includes a deletion- 
from-playback-apparatus flag written therein, the deliv- 
ery card 4 is determined as one which has been returned 
after the expiration of the playing period during which 

£ the corresponding content data was permitted to be 
played back by the playback apparatus 3. 
[0502] In step F138, the authentication/write control- 
ler 1 06 starts to delete the compressed content data cor- 
responding to that delivery card 4 from the compressed 

o data storage unit 109. That is, the content data, which 
was transmitted to the playback apparatus 3 in the past 
and the playing period of which has expired (and which 
has been deleted from the playback apparatus 3) is de- 
leted also from the relay server 2. 

5 [0503] In step F1 39, the write/write controller 1 06 de- 
termines whether the deleting process has been prop- 
erly performed. If the deleting has been completed suc- 
cessfully, the process proceeds to step F140. However, 
the deleting has been ended abnormally, the process 

0 jumps to step F1 42. 

[0504] In the case where the process has proceeded 
to step F1 40 after normal completion of deleting the con- 
tent data, the encryption unit 116 re-encrypts, under the 
control of the authentication/write controller 1 06. the de- 

> letion-from-relay-server flag having a value of "1 1 " indi- 
cating the completion of deleting the content data as well 
as the associated additional information, using the en- 
cryption key AK1 . In step F141 , the re-encrypted data 
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is written into the inserted delivery card 4 via the card 
read/write controller 105 and the card interface 111. 
Thus., the flag and the additional information written in 
the returned delivery card 4 are rewritten. 
[0505] As described earlier with reference to the first 
embodiment, it is required that when the delivery card 
4 is returned to the server 1 , the server 1 can read the 
content ID from the delivery card 4 without having to use 
the decryption key. For this purpose, in the process per- 
formed in steps F140 and F141, the content ID is not 
encrypted while the other data of the additional informa- 
tion is encrypted. 

[0506] After completion of the rewriting, the delivery 
card 4 is sent to the server 1 and subjected to the above- 
described process from step F113 to step F118 shown 
in Fig. 13. 

[0507] In step F142, a controller such as the authen- 
tication/write controller 1 06 determines whether an end 
command has been issued by a human operator. If the 
end command is detected, the process is ended. How- 
ever, if the end command is not detected, the flow re- 
turns to step F121 to repeat the above-described proc- 
ess. 

[H(2)J Process Performed by Playback Apparatus 

[0508] The process performed by the playback appa- 
ratus 3 is similar to that performed by the playback ap- 
paratus 3 according to the first embodiment described 
above with reference to Fig. 9. 

[I (2)] Advantages 

[0509] The configuration and the operation according 
to the second embodiment of the invention have advan- 
tages similar to the advantages (1 ) to (8) obtained in the 
first embodiment. 

Third Embodiment 

[A(3)] Outline 

[0510] A third embodiment is described below. 
[0511] The third embodiment has a configuration sim- 
ilar to that of the first embodiment and operates in a sim- 
ilar manner to the first embodiment. The flows of the 
content data 6 and the delivery card 4 are similar to 
those shown in Fig. 2. However, the third embodiment 
is different from the first embodiment in that the addi- 
tional information further includes data indicating the 
maximum allowable number of times the content data 6 
is played back by the playback apparatus 3 of the movie 
theater 502 to play the movie and in that a watermark 
(electronic watermark) indicating that the content data 
6 is permitted to be played back is embedded in the con- 
tent data 6. 

[0512] In this third embodiment, when the playback 
apparatus 3 receives the content data from the server 



1 , the playback apparatus 3 checks whether the play- 
back permission watermark is embedded in the re- 
ceived content data. If the watermark is detected, the 
playback apparatus 3 is allowed to play back the content 

5 data as many times as the number-of-times value de- 
scribed in the additional information. 
[0513] When the playback apparatus 3 has played 
back the content data as many times as allowed by the 
additional information, the watermark embedded in the 

10 content data (video or audio signal) is replaced with a 
playback inhibition code thereby disabling further play- 
back operation. 

[0514] The number-of-times value indicating the 
number of times the content data is allowed to be played 
'5 back is set by the movie production company 500 or the 
movie distribution company 501 in accordance with the 
agreement between the movie theater 502 and the mov- 
ie production company 500 or the movie distribution 
company 501 . 

20 

[B(3)] Configuration of Server 

[0515] Fig. 1 5 illustrates a configuration of the server 
1. As shown in Fig. 15, the server 1 has a similar con- 
25 figuration to that shown in Fig. 3 but further includes a 
watermark embedding unit 32. The server 1 is also dif- 
ferent from that shown in Fig. 3 in that additional infor- 
mation which is stored in the storage unit 12 after being 
input via the input unit 11 includes the number-of-times 
30 value indicating the number of times the content data is 
allowed to be played back, in addition to the content ID, 
the destination identifiers ID1 and ID2, and the schedule 
information. 

[0516] The watermark embedding unit 32 embeds a 
55 watermark (PN code) serving as a playback permission 
code into one or both of digital audio data and digital 
video data output from the film scanner 1 A. 
[0517] The compression coder 19 compresses the 
digital audio data and the digital video data including the 
40 embedded watermark so as to produce content data in 
a predetermined format. The resultant content data is 
written into the movie database 1 6. 
[0518] The operations of the other parts are similar to 
those of the first embodiment, and thus they are not de- 
45 scribed herein. However it should be noted that the 
number-of-times value indicating the number of times 
the content data is allowed to be played back is included 
in each of the additional information encrypted by the 
encryption unit 22, the additional information written by 
50 the card controller 1 E into the delivery card 4, and the 
additional information transmitted together with the con- 
tent data. 

[C(3)] Configuration of Card 

55 

[0519] As shown in Fig. 1 6 : the delivery card 4 is sim- 
ilar to that according to the first embodiment in that the 
delivery card 4 includes an interface 41 , a memory ac- 
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cess controller 42.. and a memory 43. 
[0520] However, the difference is that encrypted ad- 
ditional information written in the memory 43 further in- 
cludes a number-of-times value indicating the number 
of times the content data is allowed to be played back. 

[D(3)] Configuration of Relay Server 

[0521] The relay server 2 has a similar configuration 
to that shown in Fig. 5. However, a number-of-times val- 
ue indicating the number of times the content data is 
allowed to be played back is included in each of addi- 
tional information which is demodulated and decrypted 
after being received by the receiving unit 1 01 , additional 
information which is read from the delivery card 4 and 
then decrypted, additional information stored in the stor- 
age unit 110, and additional information which is stored 
together with content data in the compressed data stor- 
age unit 109 and transmitted to the movie theater 502. 

[E(3)J Configuration of Playback Apparatus 

[0522] Fig. 1 7 illustrates the structure of the playback 
apparatus 3. As shown in Fig. 17 : the playback appara- 
tus includes a watermark detection/write controller 222 
in addition to the parts shown in Fig. 6. 
[0523] A number-of-times value indicating the 
number of times the content data is allowed to be played 
back is included in each of additional information which 
is demodulated and decrypted after being received by 
the receiving unit 201, additional information which is 
read from the delivery card 4 and then decrypted, addi- 
tional information stored in the storage unit 209, and ad- 
ditional information which is stored together with content 
data in the compressed data storage unit 208. 
[0524] The watermark detection/ write controller 222 
detects a watermark embedded in content data stored 
in the compressed data storage unit 208. More specifi- 
cally, the watermark detection/write controller 222 ex- 
amines a PN code embedded in the content data and 
determines whether or not the content data is allowed 
to be reproduced. 

[0525] The watermark detection/write controller 222 
checks the number-of-times value included in the addi- 
tional information indicating the number of times the 
content data is allowed to be played back and also 
checks the number of times the content data has been 
actually played back by the digital projector 3a. Depend- 
ing upon the result of the checking, the watermark de- 
tection/write controller 222 rewrites the watermark, em- 
bedded in the content data stored in the compressed 
storage unit 208, into a playback inhibition code. 
[0526] The other parts operates in similar manners to 
those according to the first embodiment. 

[F(3)] Process Performed by Server 

[0527] Fig. 18 illustrates a process performed by the 



server 1 . In Fig. 18, similar steps to those shown in Fig. 
7 are denoted by similar step numbers, and they are not 
described in further detail herein. More specifically 
steps F2 to F28 are similar to those shown in Fig. 7. 

5 [0528] In the process shown in Fig. 18, inputting of 
data via the input unit 11 is monitored in step F150. The 
input additional information includes a number-of-times 
value indicating the number of times content data is al- 
lowed to be played back, in addition to a content ID , des- 

10 tination identifiers ID1 and ID2, schedule information. 
Step F150 checks whether these data have been input. 
[0529] If the process proceeds to step F2 after detect- 
ing inputting of the additional information, the content 
ID, the destination identifiers ID1 and ID2, the schedule 

*5 information, and the number-of-times value indicating 
the number of times the content data is allowed to be 
played back are stored as the additional information into 
the storage unit 209. In the following steps F3 to F6, 
content data is produced from a film 5 and the content 

20 data is written together with the associated additional 
information into the movie database 16. 
[0530] Note that, in step F1 51 , the watermark embed- 
ding unit 32 embeds a PN code indicating that data is 
permitted to be played back into one or both of the digital 

25 audio data and the digital video data which was read 
from the film 5 in step F4. 

[0531] Thereafter, the process is performed in a sim- 
ilar manner to that shown in Fig 7 except that the 
number-of-times value indicating the number of times 
30 the content data is allowed to be played back is included 
in the additional information dealt with in steps F11 to 
F17, F18 to F21 , F26 and F27. 

[G(3)] Process Performed by Relay Server 

35 

[0532] The process performed by the relay server 2 
is similarto that shown in Fig. 8 exceptthat the number- 
of-time value indicating the number of times the content 
data is allowed to be played back is included in the ad- 
^0 ditional information dealt with in steps F31 to F34, F37 
to F39, F43, F44, F47, and F48. 

[H(3)J Process Performed by Playback Apparatus 

45 [0533] The process performed by the playback appa- 
ratus 3 is described below with reference to Figs. 19 and 
20. The steps shown in Fig. 19 are basically similar to 
those having the same step numbers shown in Fig. 9 
except that the number-of-times value indicating the 

so number of times the content data is allowed to be played 
back is included in the additional information dealt with 
in steps F51 to F55, F59 to F62, F70 and F71 . 
[0534] In the third embodiment, in response to a play- 
back command, the playback apparatus 3 performs 

55 steps F57 to F64 to check whether a delivery card 4 is 
inserted; decryptthe additional information stored in the 
delivery card 4; check whether the additional informa- 
tion stored in the delivery card 4 is identical to the addi- 
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tional information stored in the storage unit 209; and 
check whether the present date/time is within the al- 
lowed playing period indicated by the schedule informa- 
tion. As in the process shown in Fig. 9, the above-de- 
scribed checks are required to be successfully passed 
to play back the content. However, the difference is that 
when it is determined in step F64 that the content data 
to be played back exists in the compressed data storage 
unit 208, the process proceeds to step F160 shown in 
Fig. 20 to check whether a further condition necessary 
for playback is met. 

[0535] In step F160 shown in Fig. 20, the watermark 
detection/write controller 222 detects a watermark em- 
bedded in the content data to be played back which has 
been retrieved from the compressed data storage unit 

208. 

[0536] In the next step F1 61 , it is determined whether 
the detected PN code indicates that the content data is 
permitted lo be played back. 

[0537] If the PN code indicates that the content data 
is not permitted to be played back, it is determined that 
all conditions necessary to play back the content are not 
met. and the process jumps to step F63 to display a 
warning Thereafter, the process proceeds to step F75. 
In this case, the content data is not played back. 
[0538] On the other hand, if the PN code indicates that 
the content data is permitted to be played back, the proc- 
ess proceeds to step F1 62 to further check whether the 
number-of-times value, indicating the number of times 
ino content data is allowed to be played back, described 
m the additional information corresponding to the con- 
tent datn is equal to or greater than 2. 
[0539] If the number-of-times value is equal to or 
greater !han 2. the process proceeds to step F164. In 
step F154 the number-of-times value indicating the 
number of t>mes the content data is allowed to be played 
back is decremented by 1 . Thus, under the control of 
the a jthentication/write controller 1 06, the additional in- 
formation written in the storage unit 209 is rewritten, and 
the updated additional information concerning the 
number-of-times value indicating the number of times 
the content data is allowed to be played back is supplied 
to the mserted delivery card 4 and the current additional 
information is replaced with the updated additional in- 
formation 

[0540] After updating the maximum allowable play- 
back number, the process proceeds lo step F65 shown 
in Fig. 1 9 to play back the content data using the digital 
projector 3a. 

[0541 ] Each time the content data is played back, the 
number-of-times value indicating the number of times 
the content data is allowed to be played back described 
in the additional information stored in the delivery card 
4 and also that stored in the storage unit 209 are dec- 
remented in step F164, and thus the number-of-times 
value indicates the number of times the playback appa- 
ratus 3 is allowed to further play back the content data. 
[0542] In the case where it is determined in step F1 61 



that the number-of-times value indicating the number of 
times the content data is allowed to be played back is 
equal to 1 , the playback apparatus 3 is allowed to the 
last playback operation. In this case, the process pro- 

5 ceeds to step F163 in which the watermark detection/ 
write controller 222 rewrites the watermark embedded 
in the content data into a PN code so as to indicate that 
the contenttlata is not allowed to be played back. More 
specifically, the rewritten watermark is re-compressed, 

10 combined with the content data, and rewritten into the 
compressed data storage unit 208. 
[0543] Thereafter, the process proceeds to step F65 
shown in Fig. 1 9 to start the last playback operation us- 
ing the digital projector 3a. 

15 [0544] If a playback command is detected in step F56 
after completion of the last playback operation, the con- 
tent data is not played back because step F161 detects 
that the content data is not allowed to be played back. 

20 [| (3)] Advantages 

[0545] The third embodiment has the advantages de- 
scribed below in addition to the advantages (1 ) to (8) 
described above with reference to the first embodiment. 

25 [0546] (9) The server 1 can controls the number of 
times the content data is played back by the playback 
apparatus 3 by describing the number-of-times value in- 
dicating the number of times the content data is allowed 
to be played back in the additional information in accord- 

30 ance with the contract. 

[0547] When the playback apparatus 3 has played 
back the content data as many times as indicated by the 
number-of-times value, the watermark embedded in the 
content data is rewritten so as to indicate that the con- 

35 tent data is not permitted to be played back. Thus, the 
playback apparatus 3 can no longer play back the con- 
tent data. This prevents the content data from being 
played back against the contract with the movie produc- 
tion company 500 or the movie distribution company 

40 501 . That is, it is ensured that the content data can be 
played back by the movie theater 502 only as many 
times as allowed according to the contract. 
[0548] (10) Because a PN code indicating the inhibi- 
tion of playback operation is embedded in content data 

45 which has already been played back as many times as 
allowed, the content data can no longer be played back 
even if the content data is tried to be played back using 
another playback apparatus. This protects in a highly 
reliable fashion the content data from being further 

50 played back beyond the allowed limit. 

[0549] (11) The number-of-times value stored in the 
delivery card 4 is decremented each time the content 
data is played back. This allows the server 1 to know 
how many times the content data has been actually 

55 played back in the movie theater 502 by checking the 
number-of-times value described in the delivery card 4 
returned from the movie theater 502. This is useful for 
management and for field investigation of the playing 
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status. 

Fourth Embodiment 
[A(4)] Outline 

[0550] Now., a fourth embodiment is described below. 
[0551] The fourth embodiment has a configuration 
similar to that of the first embodiment and operates in a 
similar manner to the first embodiment. The flows of the 
content data 6 and the delivery card 4 are similar to 
those shown in Fig. 2. However, the difference is that 
the playback apparatus 3 has a capability of managing 
and controlling the operation of copying the content data 
6. 

[0552] That is, if the playback apparatus 3 outputs 
content data 6, which has been stored after being re- 
ceived by means of electronic transmission, to an exter- 
nal device, and if the conLent data is copied on a storage 
medium by the external device, the playback apparatus 
ID of the playback apparatus 3 is added to the additional 
information stored in the delivery card 4. 
[0553] When the delivery card 4 has been returned to 
the server 1 , the server 1 checks whether the additional 
information stored in the delivery card 4 includes the 
playback apparatus ID. If the playback apparatus ID is 
detected, the server 1 determines that the content data 
6 has been copied by the playback apparatus 3 indicat- 
ed by the playback apparatus ID. 

[B(4)] Configuration of Server 

[0554] The server has a similar configuration to that 
shown in Fig. 3. However, the judgment unit 28 of the 
return managing unit 1D checks whether the additional 
information stored in the returned delivery card 4 in- 
cludes a playback apparatus ID. 
[0555] If a playback apparatus ID is detected, the out- 
put unit 29 issues, to the playback apparatus 3 indicated 
by the playback apparatus ID, a notification to give a 
warning or to request the playback apparatus to explain 
the reason why the copy was made. This allows the 
server to take necessary action against the playback ap- 
paratus 3 (movie theater 502) which has made the copy. 

[C(4)] Configuration of Card 

[0556] Fig. 21 illustrates the configuration of the de- 
livery card 4. As shown in Fig. 21 , the configuration is 
similar to that shown in Fig. 4. However, in the present 
embodiment, the additional information stored in the 
memory 43 can include a playback apparatus ID, de- 
pending upon the situation. 

[0557] Note that the additional information generated 
by the sever 1 does not include a playback apparatus 
ID, but a playback apparatus ID is written by the play- 
back apparatus 3 depending upon the situation. That is, 
when a delivery card 4 is returned to the server 1 , there 



is a possibility that the additional information includes a 
playback apparatus ID. 

[D(4)] Configuration of Relay Server 

5 

[0558] The relay server 2 has a similar configuration 
to that shown in Fig. 5. However, the additional informa- 
tion stored in the delivery card 4 returned from the play- 
back apparatus 3 can include the playback apparatus 
10 ID. 

[E(4)] Configuration of Playback Apparatus 

[0559] Fig. 22 illustrates the configuration of the play- 

15 back apparatus 3. The configuration is basically similar 
to that shown in Fig. 6 except that there is further pro- 
vided a digital output detector 233. 
[0560] Content data stored in the compressed data 
storage unit 208 can be output in the form of digital data. 

20 For example, when a data transfer command is issued 
from the user control unit 21 0, content data stored in the 
compressed data storage unit 208 is output to an exter- 
nal device and is copied by the external device. 
[0561] If the digital output detector 233 detects that 

25 content data has been transferred to an external device 
in response to a command issued from the user control 
unit 210, the digital output detector 233 determines that 
the content data has been copied, and the digital output 
detector 233 outputs a detection signal to the authenti- 

30 cation/write/delete controller 206. 

[0562] In response to receiving the detection signal 
from the digital output detector 233, the authentication/ 
write/delete controller 206 adds the playback apparatus 
ID stored in the playback apparatus ID storage unit 207 

35 to the additional information . The resultant additional in- 
formation including the playback apparatus ID is trans- 
mitted to the card read/write controller 205. The card 
read/write controller 205 updates the additional informa- 
tion stored in the delivery card 4 in accordance with the 

40 received additional information. 

[F(4)] Process Performed by Server 

[0563] Fig. 23 illustrates the process performed by the 
45 server 1 . In Fig. 23, similar steps to those shown in Fig. 
7 are denoted by similar step numbers, and they are not 
described in further detail herein. More specifically, 
steps F1 to F23 and steps F24to F28 are similar to those 
shown in Fig. 7. 
50 [0564] That is, the process shown in Fig. 23 is similar 
to that according to the first embodiment in that if step 
F8 determines that the inserted delivery card 4 is not a 
new card but a returned card, steps F18 to F23 are per- 
formed to decrypt the additional information stored in the 
55 delivery card; check whether the content data was cor- 
rectly used by the playback apparatus 3 only during the 
allowed period, the content data has been adequately 
deleted, and the settlement has been correctly made; 
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issue an invoice, a demand note, or a warning message 
depending upon the result of the checking. However, the 
difference is that in step F210 it is determined whether 
the additional information stored in the delivery card 4 
includes a playback apparatus ID. 5 
[0565] If no playback apparatus ID is detected, the 
process proceeds to step F24 without performing any- 
thing. However, if a playback apparatus IDns detected, 
the process proceeds to step F211 to output a warning 
message from the output unit 29 to a playback appara- 10 
tus 3 indicated by the playback apparatus ID, that is, to 
the playback apparatus 3 which used the returned de- 
livery card 4. That is, a warning regarding the unauthor- 
ized copy is given. 

15 

[G(4)] Process Performed by Relay Server 

[0566] The process performed by the relay server 2 
is similar to that shown in Fig. 8, except that the addi- 
tional information dealt with in steps F37 to F39 and F47 20 
to F48 can include a playback apparatus ID. 

[H(4)] Process Performed by Playback Apparatus 

[0567] Fig. 24 illustratesthe process performed by the 25 
playback apparatus 3. In Fig. 24, similar steps to those 
shown in Fig. 9 are denoted by similar step numbers, 
and they are not described in further detail herein. 
[0568] The process according to this fourth embodi- 
ment includes a step F201 in which the digital output 30 
detector 233 monitors whether a command is issued to 
output content data stored in the compressed storage 
unit 208 of the playback apparatus 3 to an external de- 
vice. 

[0569] In the case where outputting of digital data to 35 
make a copy of content data is detected, the process 
proceeds to step F202. In step F202 : the authentication/ 
write/delete controller 206 reads the playback appara- 
tus ID stored in the playback apparatus ID storage unit 
207 and adds it to the additional information which is *o 
stored in the storage unit 209 and which corresponds to 
the output content data. The resultant additional infor- 
mation now including the playback apparatus ID is en- 
crypted by the encryption unit 220 and transmitted to the 
card read/write controller 205. 45 
[0570] In step F203, the card read/write controller205 
writes the encrypted additional information including the 
playback apparatus ID into the delivery card 4. For ex- 
ample, the playback apparatus ID is written in the deliv- 
ery card 4 in such as manner as shown in Fig. 21 . so 

[l(4)] Advantages 

[0571] The fourth embodiment has the advantages 
described below in addition to the advantages (1) to (8) 55 
described above with reference to the first embodiment. 
[0572] (12) The server 1 is capable of checking 
whether content data has been copied by a particular 



playback apparatus 3, on the basis of information de- 
scribed in a returned delivery card 4. If unauthorized 
copying of content data is detected, the server 1 can 
give. a warning or take action such as demanding of a 
penalty for breach of contract. 

[0573] (13) By monitoring the copying operation per- 
formed by the playback apparatus 3, it becomes possi- 
ble to preventing content data from being copied in an 
unauthorized manner by the playback apparatus 3. This 
ensures highly reliable protection of copyright. 
[0574] (14) Unauthorized copying can be monitored 
simply by checking information described in a returned 
delivery card 4 without having to use an additional spe- 
cial monitoring system. This makes it possible to easily 
perform monitoring for a very large number of movie 
theaters 502 to which content data is distributed. 

Fifth Embodiment 

[A(5)] Outline 

[0575] Now, a fifth embodiment is described below. 
[0576] The fifth embodiment has a configuration sim- 
ilar to that of the first embodiment and operates in a sim- 
ilar manner to the first embodiment. The flows of the 
content data 6 and the delivery card 4 are similar to 
those shown in Fig. 2. However, the difference is that 
after the delivery card 4 is inserted into the playback ap- 
paratus 3, the delivery card is required to be maintained 
in the inserted state without being removed. 
[0577] That is, once a delivery card 4 corresponding 
to content data to be played back is inserted into the 
playback apparatus 3, it is required that the delivery card 
4 must be maintained in the inserted state until the play- 
ing period has expired. If the delivery card 4 is removed 
in the middle of the playing period, it becomes impossi- 
ble to further play back the content data even if the de- 
livery card 4 is re-inserted. 

[B(5)] Configuration of Server 

[0578] In this embodiment, the server has a similar 
configuration to that shown in Fig. 3. 

[C(5)] Configuration of Card 

[0579] The configuration of the delivery card 4 is sim- 
ilar to that shown in Fig. 4. 

[D(5)] Configuration of Relay Server 

[0580] The relay server 2 has a similar configuration 
to that shown in Fig. 5. 

[E(5)] Configuration of Playback Apparatus 

[0581] The configuration of the playback apparatus 3 
is similar to that shown in Fig. 6 except that the authen- 
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tication/write/delete controller 206 includes a counter for 
counting the number of times a playback command is 
issued, and the authentication/write/delete controller 
206 controls the operation of rewriting the additional in- 
formation stored in the delivery card 4 depending upon 
the counter value. 

[F(5)] Process Performed by Server 

[0582] The process performed by the server 1 is sim- 
ilar to that shown in Fig. 7. 

[G(5)J Process Performed by Relay Server 

[0583] The process performed by the relay server 2 
is similar to that shown in Fig. 8. 

[H(5)] Process Performed by Playback Apparatus 

[0584] The process performed by the playback appa- 
ratus 3 is described below with reference to Figs. 25 and 
26. In Fig. 25, similar steps to those shown in Fig. 9 are 
denoted by similar step numbers, and they are not de- 
scribed in further detail herein. 

[0585] In the fifth embodiment, if a playback com- 
mand issued by a human operation is detected in step 
F56 and if it is determined in step F57 that a delivery 
card 4 is inserted, the process proceeds to step F301 in 
which the internal counter of the authentication/write/ 
delete controller 206 serving as a playback counter Cp 
is incremented. 

[0586] In step F302. it is determined whether the val- 
ue of ihe playback counter Cp is equal to or greater than 
2 The process branches to different steps depending 
upon the counter value. 

[0587] The playback counter Cp is reset by an inter- 
ruot routine shown in Fig. 26. 

[0588] That is. if the card read/write controller 205 de- 
tects that the delivery card 4 has been removed, the au- 
thentica:ion/write/deiete controller 206 performs the in- 
terrupt routine shown in Fig. 26. That is, in step F311, 
after detecting removal in step F31 0, the playback coun- 
ter Cd is reset to 0. 

[0589] Because the playback counter Cp is incre- 
mented in step F301 in Fig. 25 when the delivery card 
4 remains in the inserted state, but it is reset when the 
delivery card 4 is removed, the value of the playback 
counter Cp indicates the number of times the content 
data has been played back while maintaining the deliv- 
ery card 4 in the inserted state. 

[0590] When the content data is played back for the 
first time after the delivery card 4 is inserted, the play- 
back counter Cp has a value of 1 . 
[0591] In this case, the process proceeds from step 
F302 to step F59 in which the card read/write controller 
205 reads the encrypted decryption key DK1 and the 
additional information from the delivery card 4. 
[0592] In step F60, the decryption key DK1 is decrypt- 



ed using the decryption key DK2 generated by the key 
generator 204. In step F61 , the additional information is 
decrypted using the decryption key DK1 . 
[0593] Instep F303, the decrypted additional informa- 

5 tion is stored into the storage unit 209 under the control 
of the authentication/write controller 106. 
[0594] In the next step F304, the authentication/write 
controller 106 rewrites the schedule information includ- 
ed in the additional information so as to indicate that the 

10 playing period has expired. The resultant additional in- 
formation now indicating that the playing period has ex- 
pired is encrypted by the encryption unit 220 and trans- 
ferred to the card read/write controller 205. Instep F305, 
the additional information is written into the delivery card 

is 4. 

[0595] For example, if the playing period indicated by 
the schedule information read from the delivery card 4 
before performing the rewriting is "2001 .1 .1 -2001 .3.31", 
and if the present date is December 30, 2000, then the 

20 schedule information stored in the delivery card 4 is re- 
written into, for example, "2000.1 .1-2000,3.31" so as to 
indicate that the playing period has expired. 
[0596] That is, if the additional information is read 
again in steps F59 to F61 after the delivery card 4 was 

25 removed, the additional information is rewritten so as to 
indicate that the playing period has expired. 
[0597] If, in step F302, the playback counter Cp is de- 
tected as being equal to 1 , when the content data is 
played back for the first time after inserting the delivery 

30 card 4, steps F59 to F305 are performed first and then 
the process proceeds to step F306. 
[0598] However, if the playback counter Cp detected 
in step F302 is equal to or grater than 2, when the con- 
tent data is played back a second or later time after in- 

35 serting the delivery card 4, the process proceeds directly 
to step F306 without performing steps F59 to F305. 
[0599] In step F306, the authentication/write control- 
ler 206 determines whether the additional information 
which was received together with the content data from 

40 the relay server 2 and stored in the storage unit 209 via 
the process from step F52 to step F55 is identical to the 
additional information which was read from the delivery 
card 4 and stored in the storage unit 209 via the process 
from step F59 to step F303. If they are identical to each 

45 other, the authentication/write controller 206 further de- 
termines whether the present time is within the allowed 
playing period indicated by the schedule information in- 
cluded in the additional information. 
[0600] That is, when the content data is tried to be 

50 played back for the first time after the delivery card 4 is 
inserted, the additional information is read from the de- 
livery card 4 and is compared with the additional infor- 
mation which has been received via electronic transmis- 
sion, and then the schedule information is checked. 

55 [0601 ] In the case where the additional information is 
valid and the present time is within the allowed playing 
period, the process proceeds to step F64. However, in 
the case where the additional information is invalid or in 
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the case where the presenttime is not within the allowed 
playing period although the additional information is val- 
id, the process proceeds to step F63 to display a warn- 
ing on the display unit 213 because the contract does 
not allow the content data to be played back. The proc- 5 
ess then proceeds to step F75. 

[0602] As a matter of course, as in the first embodi- 
ment described earlier with reference to Fig. 9 : in the 
case where the content data is tried to be played back 
when the delivery card 4 corresponding to the content 10 
data is not inserted or in the case where the playing pe- 
riod allowed for the content data has already expired, it 
is determined in step F306 that the required playback 
condition is not met, and a warning is displayed. In such 
a case, the content data is not allowed to be played is 
back, as in the process according to the first embodi- 
ment described above with reference to Fig. 9. 
[0603] In the present embodiment, not only in such a 
situation, but step F306 determines that the playback 
condition is not met, and the playing back of the content 20 
data is disabled also in the case where the content data 
is tried to be played back by re-inserting the delivery 
card 4 which was removed, even if the present time is 
within the playing period. 

[0604] That is, as described above, In step F306, the 25 
authentication/write controller 206 determines whether 
when the content data is tried to be played back for the 
first time after inserting the delivery card 4, it is deter- 
mined in step F306 whether the additional information 
read from the delivery card 4 is identical to the additional 30 
information received from the relay server 2 via elec- 
tronic transmission. Note that the schedule information 
of the delivery card 4 has been rewritten in step F305 
so as to indicate that the allowed playing period has ex- 
pired. 35 
[0605] If a playback command is issued after re-in- 
serting the delivery card 4 wh ich was removed once dur- 
ing the allowed playing period, it is determined in step 
F302 that the playback counter Cp has a value equal to 
1 because the playback counter Cp was reset to 0 in the 40 
process shown in Fig. 26 when the delivery card 4 was 
removed, and thus steps F59 to F305 are performed. 
[0606] In this case, because the additional informa- 
tion including the rewritten schedule information is com- 
pared, in step F306, with the additional information in- 45 
eluding the original schedule information which has 
been received via electronic transmission, it is deter- 
mined that they are not identical to each other, that is, 
it is determined that the playing period is invalid. 
[0607] In this case, a warning is displayed in step F63, so 
and the content data is not allowed to be played back. 
[0608] When the delivery card 4 remains in the insert- 
ed state without being removed, it is determined in step 
F306 that the additional information is valid, because, 
in this case, the original additional information which 55 
was read from the delivery card 4 and stored, in step 
F303, into the storage unit 209 without being changed 
is compared with the additional information which was 



received via electronic transmission. 
[0609] Therefore, as long as the delivery card 4 main- 
tained in the inserted state without being removed, the 
process proceeds to step F64 in which the content data 
to be played back is retrieved from the compressed data 
storage unit 208, and the retrieved content data is start- 
ed to be played back in the next step F65. 
[061 0] In the case where the playback command from 
the user control unit 210 is not detected in step F56, or 
in the case where completion of playback operation is 
detected in step F66, the process proceeds to step F67 
to determine whether a command to delete the content 
data has been issued from the user control unit 210. If 
the delete command is detected, the process proceeds 
to step F68. 

[0611] Deleting the content data is performed by the 
playback apparatus 3 when the allowed playing period 
has expired. 

[0612] As in the first embodiment described earlier 
with reference to Fig. 9, the deleting is performed such 
that the content data is deleted, in step F68, from the 
compressed data storage unit 208 and then it is con- 
firmed in step F69 that the content data has been suc- 
cessfully deleted. However, in the present embodiment, 
after confirming that the content data has been deleted 
successfully, the process proceeds to step F307 to re- 
write the additional information of the delivery card 4 into 
the original one. 

[0613] More specifically, the authentication/write/de- 
lete controller 206 reads the original additional informa- 
tion which is retained in the storage unit 209 without be- 
ing changed, and sets the deletion-from-playback-ap- 
paratus flag so as to indicate that the content data has 
been deleted. The resultant additional information is en- 
crypted by the encryption unit 220 and transferred to the 
card read/write controller 205. 

[0614] In step F71 , the additional information includ- 
ing the deletion-from-playback-apparatus flag is written 
into the inserted delivery card 4 via the card interface 
211 under the control of the card read/write controller 
205. 

[0615] That is, before returning the delivery card 4, 
the schedule information which was changed is rewrit- 
ten so as to have the original value, and the deletion- 
from-playback-apparatus flag is added to the additional 
information. 

[0616] When the server 1 checks the additional infor- 
mation described in the returned delivery card 4, no 
problem occurs because the schedule information has 
the correct value. 

[0617] As described earlier with reference to the first 
embodiment, it is required that when the delivery card 
4 is returned to the relay server 2, the relay server 2 can 
read the content ID from the delivery card 4 without hav- 
ing to use the decryption key. To this end, in the process 
performed in steps F70 and F71, the content ID is not 
encrypted while the other data of the additional informa- 
tion is encrypted. 
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[l(5)] Advantages 

[0618] The fifth embodiment has the advantages de- 
scribed below in addition to the advantages (1) to (8) 
described above with reference to the first embodiment. 
[061 9] (15) After inserting the delivery card 4 into the 
playback apparatus 4, the delivery card 4 is required to 
be maintained in the inserted state during the allowed 
paying period. To further playback the content data in 
the playing period, the delivery card 4 must be main- 
tained in the inserted state without being removed. This 
prevents the delivery card 4 from being dealt with for 
another purpose during the playing period, and thus pre- 
vents the additional information or the flag described in 
the delivery card 4 from being rewritten in an unauthor- 
ized fashion. 

[0620] More specifically, this prevents the schedule 
information from being changed such that the allowed 
playing period is extended. Furthermore, the content da- 
ta is prevented from being played back in an unauthor- 
ized fashion. Still furthermore, the destination identifier 
ID2 is prevented from being changed. Note that if the 
destination identifier ID2 is changed, the delivery card 
4 can be used by a playback apparatus having the 
changed destination identifier ID2. 
[0621 ] ( 1 6) If the delivery card 4 is removed after the 
expiration of the playing period and before deleting the 
content data, the schedule information of the delivery 
card 4 is rewritten into a value different from the value 
which was originally assigned to the playback apparatus 
3. Therefore, the server 1 can check whether the deliv- 
ery card 4 was inadequately removed from the playback 
apparatus 3 by examining the schedule information 
stored in the returned delivery card 4. The server 1 can 
take adequate action if necessary. 

Sixth Embodiment 

[A(6)] Outline 

[0622] A sixth embodiment is described below. In the 
sixth embodiment, the playback apparatus 3 has a ca- 
pability of transmitting a request message to the server 
1 to ask it to extend the playing period. If the request is 
accepted, it becomes possible for the playback appara- 
tus 3 to update the additional information. More specif- 
ically the playback apparatus 3 can update the sched- 
ule information described in the delivery card 4 so that 
the playback apparatus 3 can play back the content data 
during the extended period. 

[0623] Fig. 27 illustrates the flows of information and 
the delivery card 4. The content data 6 is transmitted 
and the delivery card 4 is delivered and returned in sim- 
ilar manners to those shown in Fig. 2 except that the 
playback apparatus 3 can transmits a request for ex- 
tending the playing period to the server 1 . 
[0624] In response to receiving the request, the server 
1 determines whether or not to permit the extension. 



When the server 1 decides to permit the extension, the 
server 1 transmits, to the playback apparatus 3, a mes- 
sage indicating that additional information including 
schedule information having a value corresponding to 
5 an extended period is allowed to be employed as new 
additional information. 

[0625] Upon receiving the permission message, the 
playback apparatus 3 updates the additional information 
stored in the delivery card 4 and that stored in the stor- 

10 age unit 209 of the playback apparatus 3 so that the 
playback apparatus 3 can playback the content data 
during the extended playback period. 
[0626] When the request for extension of the playback 
period is refused by the server 1 , the playback appara- 

15 tus 3 cannot update the additional information to extend 
the playing period. 

[0627] The transmission of the period extension re- 
quest from the playback apparatus 3 to the server 1 and 
the transmission of the new additional information from 
20 the server 1 to the playback apparatus 3 may be per- 
formed via the relay server 2. 

[0628] The reception of the period extension request, 
the decision on whether to permit the extension of the 
period, and the transmission of the new additional infor- 
ms mation may be performed by the relay server 2. 

[0629] Although in the present embodiment, the re- 
writing of the additional information is performed by the 
playback apparatus 3, the delivery card 4 may be re- 
turned to the server t or the relay server 2 and the server 
30 1 or the relay server 2 may rewrite the additional infor- 
mation stored in the delivery card 4. 
[0630] The extension of the playing period may be 
permitted not only in response to a request issued by 
the playback apparatus 3, but the playing period may 
35 also be extended by the relay server 2 or the server 1 
according to their will, That is, the movie production 
company 500 or the movie distribution company 501 
may extend the playing period during which the movie 
is allowed to be shown in the movie theater 502 even if 
40 an extension request is not issued by the movie theater 
502. 

[0631] The period extension request issued by the 
playback apparatus 3 may be generated in various 
forms, and a period extension permission message 

45 transmitted in response to the period extension request 
may be generated in various forms. 
[0632] First, the playback apparatus 3 generates a 
period extension request including new additional infor- 
mation which includes new schedule information indi- 

50 eating a new desired playing period. The generated pe- 
riod extension request is transmitted to the server 1 . The 
server 1 determines whetherto accept the new addition- 
al information and transmits a permission/refusal mes- 
sage together with encrypted new additional informa- 

55 tion. In accordance with the received message, the play- 
back apparatus 3 rewrites the current additional infor- 
mation into the new additional information. The process 
associated with extension of the playing period, which 
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will be described later, is also performed in a similar 
manner. 

[0633] In response to the period extension request is- 
sued by the playback apparatus 3, the server 1 not only 
determines whether to accept the new additional infor- 
mation including the new desired schedule information, 
but the server 1 may modify the new additional informa- 
tion. In this case, the server 1 transmits the modified 
new additional information together with the permission 
message to the playback apparatus 3. The playback ap- 
paratus 3 rewrites the current additional information in 
the received new additional information. 
[0634] Alternatively, the playback apparatus 3 may 
simply issue a request for extension of the playing peri- 
od. In response to the request, the server 1 may deter- 
mine a new extended playing period and creates new 
additional information including new schedule informa- 
tion indicating the new extended playing period. The 
created new additional information is transmitted to the 
playback apparatus 3. The playback apparatus 3 up- 
dates the additional information in accordance with the 
received new additional information. 
[0635] The information transmitted between the play- 
back apparatus 3 and the server 1 to extend the period 
is not limited to the above examples, . but the information 
may also be formed in various fashions so that the pe- 
riod can be extended in response to the request issued 
by the playback apparatus 3. 

[B(6)] Configuration of Server 

[0636] Fig. 28 illustrates the configuration of the serv- 
er 1 . As shown in Fig. 28, the server 1 includes a receiv- 
ing unit 35, a demodulator 36, and a schedule controller 
37 in addition to the parts shown in Fig. 3. 
[0637] The receiving unit 35 receives information via 
the transmission line 7. In particular, the receiving unit 
35 is used to receive a period extension request issued 
by the playback apparatus 3. 

[0638] In the case where PSK-modulated information 
is received, the demodulator 36 performs PSK demod- 
ulation upon the received signal. 
[0639] The received information, that is, the period ex- 
tension request from the playback apparatus 3, is sup- 
plied to the schedule controller 37 after being demodu- 
lated. 

[0640] The period extension request is assumed to in- 
clude new additional information including new sched- 
ule information requested by the playback apparatus 3. 
[0641] From the additional information included in the 
period extension request received from the playback ap- 
paratus 3, the schedule controller 37 detects the extend- 
ed period requested by the playback apparatus 3. The 
schedule controller 37 then checks whether the addi- 
tional information (data such as the content ID other 
than the schedule information) is identical to the addi- 
tional information stored in the schedule managing unit 
26. The schedule controller 37 determines whether to 



permit the extension of the playing period requested by 
the playback apparatus 3, on the basis of the result of 
the checking of the validity of the additional information 
and in accordance with an extension permission judg- 
5 ment program or in accordance with a command issued 
via the input unit 11. 

[0642] When the schedule controller 37 decides to 
permit the extension, the schedule controller 37 trans- 
mits new additional information to the encryption unit 22. 

10 After being encrypted by the encryption unit 22, the new 
additional information is transmitted together with a sig- 
nal indicating the permission to the playback apparatus 
3 via the modulator 30 and the transmitting unit 31 . 
[0643] As described above, the schedule controller 37 

is may modify the new additional information requested by 
the playback apparatus 3. For example, the playing pe- 
riod may be extended to a period shorter than is request- 
ed, andthe resultant new additional information is trans- 
mitted after being encrypted. 

20 

[C(6)] Configuration of Card 

[0644] The configuration of the delivery card 4 is sim- 
ilar to that shown in Fig. 4. 

25 

[D(6)] Configuration of Relay Server 

[0645] The configuration of the relay server 2 is similar 
to that shown in Fig. 5. 

30 

[E(6)J Configuration of Playback Apparatus 

[0646] Fig. 29 illustrates the structure of the playback 
apparatus 3. As shown in Fig. 29, the playback appara- 

35 tus 3 includes a modulator 241 and a transmitting unit 
242 in addition to the parts shown in Fig. 6. 
[0647] That is, the playback apparatus 3 is construct- 
ed so as to having a capability of transmitting a period 
extension request to the server 1 . 

40 [0648] When the period extension request is transmit- 
ted, new additional information including schedule infor- 
mation indicating a desired period is created in accord- 
ance with data input by a human operator via the user 
control unit 210. For example, the content of the addi- 

45 tional information which corresponds to a certain con- 
tent data and which is stored in the storage unit 209 is 
displayed on the display unit 213 so that the human op- 
erator can change the date value of the schedule infor- 
mation indicating the playing period by operating the us- 

50 er control unit 210. 

[0649] The new additional information created by the 
playback apparatus 3 in the above-described manner is 
supplied to modulator 241 and PSK-modulated. The 
modulated new additional information is transmitted 

55 from the transmitting unit 242 to the server 1 via the 
transmission line 7. 

[0650] On the other hand, the signal indicating the 
permission/refusal of the new additional information and 
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the encrypted new additional information from the serv- 
er 1 are received by the receiving unit 201 and PSK- 
demodulated by the demodulator 202. Thereafter, the 
permission/refusal signal and the new additional infor- 
mation are decrypted by the decryption unit 203 in a 
manner similar to that in which the received content data 
is decrypted, and the decrypted signal and information 
are applied to the authentication/write/delete controller 
206. 

[0651] In accordance with the new additional informa- 
tion received together with the permission message, the 
authentication/write/delete controller 206 updates the 
additional information stored in the storage unit 209. 
[0652] Furthermore, the received new additional in- 
formation is encrypted by the encryption unit 220 and 
transmitted to the card read/write controller 205. The 
card read/write controller 205 writes the encrypted new 
additional information into the inserted delivery card 4. 

[F(6)] Process Performed by Server 

[0653] The flow chart of the process performed by the 
server is shown in Figs. 30 and 31. in these figures, 
steps F1 to F6 and steps F7 to F28 are similar to steps 
having similar step numbers shown in Fig. 7. That is, the 
inputting of additional information, conversion of a film 
5 into content data, encryption, transmission of content 
data and additional information, production of a delivery 
card 4, and checking of a returned delivery card 4 are 
performed in similar manners to those shown in Fig. 7. 
[0654] These steps are not described in further detail, 
but the process performed in response to receiving a 
period extension request from the playback apparatus 
3 is described below. 

[0655] In step F401, the receiving unit 407 monitors 
whether a period extension request has been received 
together with new additional information from the play- 
back apparatus 3. When the request is not detected, the 
process proceeds from step F401 to step F7 shown in 
Fig. 31 to perform a process associated with the delivery 
card 4. 

[0656] In the case where the receiving unit 35 detects 
that the period extension request issued by the playback 
apparatus 3 has been received, the process proceeds 
from step F401 to F402. In step F402, the demodulator 
36 demodulates the received signal, and the resultant 
demodulated information is supplied to the schedule 
controller 37. Thus, the schedule controller 37 acquires 
the new additional information requested by the play- 
back apparatus 3 as well as the period extension re- 
quest. 

[0657] In step F403, the schedule controller 37 exam- 
ines the content of the acquired new additional informa- 
tion and determines whether the extension of the play- 
ing period should be permitted. 

[0658] More specifically, the schedule controller 37 
compares the received new additional information and 
the additional information (having the same content ID 
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as that of the received new additional information) 
stored in the schedule managing unit 26 to check wheth- 
er data other than the schedule information are identical. 
Furthermore, in accordance with a judgment program, 

5 the schedule controller 37 determines whether the ex- 
tension of the period is permitted or refused. For exam- 
ple, the judgment program judges whether the addition- 
al information is consistent and/or whetherthe schedule 
information included in the new additional information 

10 has a proper value within an allowable range, and the 
judgment program determines whetherthe request for 
extension should be permitted or refused, depending 
upon the result of the judgment. 

[0659] The judgment, for a movie theater which has 

15 issued a request for extension and which is indicated by 
the destination identifier ID2, may be made using the 
judgment program, on the basis of other items such as 
the contract condition, the playing history of the movie 
theater 502, or the history of violence of the contract. 

20 Alternatively, taking into these conditions and factors, a 
human operator may input a permission/refusal com- 
mand via the input unit 11 . Still alternatively, the human 
operator may input a condition, and the schedule con- 
troller 37 may determine whether to accept or refuse the 

25 request in accordance with the input condition. 

[0660] In the case where it is determined that the ex- 
tension should be refused, the process proceeds from 
step F403 to step F7 shown in Fig. 31 . In this case, the 
permission message and the encrypted new additional 

30 information are not transmitted to the playback appara- 
tus 3. 

[0661] Although not shown in the flow charts, when 
the extension request is refused, it is preferable to trans- 
mit a refusal message to the playback apparatus 3. 

35 [0662] In the case where the extension is permitted, 
the process proceeds to step F404 in which the encryp- 
tion unit 22 encrypts the new additional information un- 
der the control of the schedule controller 37. In step 
F405, the additional information described together with 

40 the content data in the movie database 1 6 is updated in 
accordance with the new additional information. That is, 
the old additional information in the movie database 16 
is replaced with the new additional information decrypt- 
ed by the decryption unit 22. 

45 [0663] In step F406, the updated new additional infor- 
mation is then read from the movie database 1 6 and 
transmitted to the modulator 30 and PSK-modulated. In 
step F407, the resultant PSK-modulated additional in- 
formation is transmitted from the transmitting unit 31 to 

so the playback apparatus 3. 

[G(6)] Process Performed by Relay Server 

[0664] The process performed by the relay server 2 
55 is similar to that shown in Fig. 8. 
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[H(6)] Process Performed by Playback Apparatus 

[0665] The process performed by the playback appa- 
ratus 3 is described below with reference to Figs. 32 and 
33. In these figures, similar steps to those shown in Fig. 
9 are denoted by similar step numbers, and they are not 
described in further detail herein. The process is similar 
in that the received content data can be played back if 
it is determined that the additional information received 
via electronic transmission and the additional informa- 
tion recorded in the delivery card 4 are identical to each 
other, and if the schedule information is valid. The proc- 
ess performed in response to a command to delete the 
content data and the process performed in response to 
a pay command are also similar. 
[0666] When it is desired to extend the playing period 
of content data which is within the currently allowed 
playing period or whose playing period has expired, the 
operator of the playback apparatus 3 inputs new addi- 
tional information indicating a desired new period via the 
user control unit 210. 

[0667] In the process performed by the playback ap- 
paratus 3, as shown in Figs. 32 and 33. issuing of a pe- 
riod extension request by a human operator is moni- 
tored in step F420. 

[0668] If new additional information including sched- 
ule information indicating a desired playing period is in- 
put thereby issuing a period extension request, the proc- 
ess of the playback apparatus 3 proceeds from step 
F420 to F422. In step F422, the modulator 241 modu- 
lates the input new additional information together with 
the extension request message. In step F422, the mod- 
ulated new additional information is transmitted from the 
transmitting unit 242 to the server 1 . 
[0669] In response to receiving the period extension 
request, the server 1 performs the process described 
earlier. In the case where the request is accepted, a per- 
mission massage is transmitted together with encrypted 
new additional information. 

[0670] In step F423, reception of the permission mes- 
sage and the encrypted new additional information 
transmitted from the server 1 is monitored. When recep- 
tion is not detected, the process awaits the arrival of the 
permission message while repeating the monitoring 
process in steps F72, F75, F51 , and F56. 
[0671] If the receiving unit 201 receives the extension 
permission message and the encrypted new additional 
information from the server 1 , the process proceeds 
from step F423 to F424. In F424, the received message 
and information are demodulated by the demodulator 
202. In step F425, the decryption unit 203 decrypts the 
received new additional information in the encrypted 
form. The decryption is performed in a manner similar 
to that in which additional information received together 
with content data is decrypted. 

[0672] In the next step F426, the authentication/write/ 
delete controller 206 updates the additional information 
stored in the storage unit 209 in accordance with the 



decrypted new additional information. 
[0673] In step F427, the authentication/write/delete 
controller 206 checks, via the card read/write controller 
205, whether a delivery card 4 is inserted. If no inserted 
5 delivery card 4 is detected, the process proceeds to step 
F428 to display a warning on the display unit 213 there- 
by asking the operator to insert a delivery card 4. The 
warning is displayed until a delivery card 4 is inserted. 
[0674] If an inserted delivery card 4 is detected, the 
10 process proceeds to step F429 in which the* new addi- 
tional information is encrypted by the encryption unit 220 
and transferred to the card read/write controller 205. In 
step F430, the card read/write controller 205 writes the 
encrypted new additional information into the delivery 
15 card 4. That is, the additional information stored in the 
delivery card 4 is updated in accordance with the new 
additional information. 

[0675] As described above, in the case where the ex- 
tension is permitted, the additional information stored in 
the storage unit 209 and the additional information 
stored in the delivery card 4 are updated in accordance 
with the new additional information so that the schedule 
information indicates the extended new playing period. 
Thus, as long as the present time is within the new al- 
lowed paying period, even after the end of the original 
playing period, it is determined in step F62 that the 
present time is within the allowed playing period, and 
the process can proceed to steps F64 and F65 to play 
back the content data. 

[1(6)] Advantages 

[0676] The sixth embodiment has the advantages de- 
scribed below in addition to the advantages (1) to (8) 
described above with reference to the first embodiment. 
[0677] (17) When the playback apparatus 3 (movie 
theater 502) wishes to extend the playing period for a 
certain movie, because, for example, the movie is favo- 
rably received, the playback apparatus 3 can extend the 
playing period by issuing a period extension request to 
the server 1 . That is, in the movie distribution system 
according to the present embodiment, it is possible to 
flexibly control the allowed playing period. This is very 
advantageous in managing the movie distribution sys- 
tem. 

[0678] (18) Requesting the extension of the playing 
period can be performed simply by transmitting a period 
extension request from the playback apparatus 3, and 
the extension can be achieved simply by transmitting a 
permission message from the server 1 to the playback 
apparatus 3. That is, extension of the playing period can 
be easily and quickly performed without needing any 
complicated operation. 

[0679] (19) The server 1 can determine whether to 
permit extension, taking account various factors. This 
allows the server 1 to manage and control the distribu- 
tion of the content data. For example, the server 1 can 
determine whether to permit extension, depending upon 
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whether unauthorized use is performed by an user. This 
ensures that the contract is well kept and that the cop- 
yright is protected in a highly reliable fashion. 

Seventh Embodiment 

[A(7)] Outline 

[0680] Now, a seventh embodiment is described be- 
low. 

[0681] In the first to sixth embodiments described 
above, a delivery card 4 issued by the server 1 is deliv- 
ered to each movie theater 502. In contrast, in this sev- 
enth embodiment and also in the following embodi- 
ments, each movie theater 502 uses one IC card (one 
IC card for at lest one content data) to play back a movie. 
(Hereinafter, the IC card is referred to as a playback 
card.) 

[0682] Fig. 34 illustrates a movie distribution system 
according to the seventh embodiment of the present in- 
vention. As shown in Fig. 34, the server 1 converts a 
movie film 5, which has been edited after being shot, 
into the form of content data 6 so as to be able to be 
transmitted to movie distribution companies 501 via a 
transmission line 7. 

[0683] In addition to the content data 6, the server 7 
also produces delivery cards 4 to be distributed to the 
movie distribution companies 501 . The server 1 produc- 
es as many delivery cards 4 as there are movie distri- 
bution companies 501 to which the delivery cards 4 are 
to be delivered. 

[0684] The server 1 encrypts the content data and the 
associated additional information and transmits them to 
the relay servers 2 of the respective distribution compa- 
nies 501 . Furthermore, the server 1 sends one delivery 
card 4 in which the additional information is stored to 
each movie distribution company 501 . 
[0685] In each movie distribution company 501, the 
relay server 2 receives the transmitted content data 6 
and the associated additional information and also re- 
ceives the transported delivery card 4. 
[0686] The relay server 2 performs a necessary proc- 
ess upon the content data 6 and the information stored 
on the delivery card 4. In particular, the relay server 2 
writes the additional information described in the deliv- 
ery card 4 into the playback cards 8 received from the 
respective movie theaters 502. 

[0687] The relay server 2 transmits the encrypted 
content data 6 and associated additional information to 
each movie theater 502. Separately, the relay server 2 
delivers the a playback card 8 to each movie theater 
502. 

[0688] The playback apparatus 3 in each movie theat- 
er 502 receives the content data 6 and the associated 
additional information. The playback apparatus 3 also 
reads the additional information and other information 
stored on the playback card 8 received from the relay 
server 2. Using a key read from the playback card 8, the 
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playback apparatus 3 decrypts the encrypted content 
data and additional information, and plays back the con- 
tent data 6 in accordance with the additional information 
read from the playback card 8. 
5 [0689] When a movie theater 502 wants to receive 
new content data from the relay server 2, the movie 
theater 502 sends, in advance, a playback card 8 
uniquely assigned to the movie theater 502 to the relay 
server 2. 

10 [0690] In the playback apparatus 3 of the movie theat- 
er 502, when the allowed playing period of content data 
has expired, the content data 6 stored in the playback 
apparatus 3 is deleted as in the previous embodiments 
described above. I n response to deleting the content da- 
is ta 6, a delete flag indicating that the content data 6 has 
been deleted is written into the playback card 8. 
[0691] When the relay server 2 receives the playback 
card 8 sent from the movie theater 502, the. relay server 
2 checks the information stored in the playback card 8 
20 to determine whether the corresponding content data 6 
was used in an authorized manner. Depending upon the 
result of the checking, the relay server 2 writes the same 
additional information as that stored in the delivery card 
4 issued by the server 1 into the playback card 8. The 
25 resultant playback card 8 is delivered to the movie theat- 
er 502 so that the movie theater 502 can use the play- 
back card 8 to play back content data which wi II be trans- 
mitted next. 

[0692] When the relay server 2 receives the playback 
30 card 8 from the movie theater 502, the relay server 2 
detects the flags or the like described in the playback 
card 8 and writes the detected flags together with the 
identifier (playback ID) uniquely assigned to the play- 
back card 8 into the delivery card 4 and returns the de- 
35 livery card 4 to the server 1 . 

[0693] The server 1 checks the information described 
in the received delivery card 4 to determine whether the 
corresponding content data has been correctly deleted 
and whether payment for the fee has been correctly 
40 made. 

[B(7)] Configuration of Server 

[0694] The configuration of the server 1 is similar to 
^5 that shown in Fig. 3. 

[C(7)] Configuration of Cards 

[0695] Figs. 35A and 35B illustrate the configurations 
so of the delivery card 4 and the playback card 8, respec- 
tively. 

[0696] The delivery card 4 includes an interface 41 , a 
memory access controller 42, and a memory 43. As in 
the delivery card 4 shown in Fig. 4, the decryption key 
55 DK1 and the additional information decrypted by the 
server 1 are written in the delivery card 4. 
[0697] Note that the delete flag and the settlement 
completion flag are not recorded by the playback appa- 
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ratus 3, but these data are copied from the playback 
card 8 by the relay server 2. Although not shown in the 
figure, various flags are copied from a plurality of play- 
back cards 8. For this reason, each flag is recorded to- 
gether with a corresponding playback card ID. 
[0698] The playback card 8 is similar in structure to 
the delivery card 4 and includes an interface 81 , a mem- 
ory access controller 82, and a memory 83. 
[0699] As shown in Fig. 35 B, the encrypted decryption 
key DK1 and the encrypted additional information in- 
cluding the content ID, the destination identifiers ID1 
and ID2, and the schedule information are copied by the 
relay server 2 from the delivery card 4 into the playback 
card 8. In the delivery card 4, destination identifiers ID2 
of all playback apparatuses 3 to which the content data 
is to be transmitted are recorded. However, only a des- 
tination identifier ID2 indicating a playback apparatus 3 
which will use a playback card 8 is copied into that play- 
back card 8. 

[0700] In the playback apparatus 3, a delete flag or a . 
settlement completion flag are recorded in response to 
deleting process or payment process. 
[0701] Furthermore, the playback card 8 includes a 
playback card ID which is an identifier uniquely assigned 
to the playback card 8. Note that the playback card ID 
is recorded in such a manner that it cannot be rewritten. 
In the case where the playback card ID is not consistent 
with the destination identifier ID2, the data may not be 
copied to the playback card 8. 

[D(7)] Configuration of Relay Server 

[0702] Fig. 36 illustrates the configuration of the relay 
server 2. As shown in Fig. 36, the relay server 2 includes 
an input unit 117, a judgment unit 130, and a display unit 
131 , in addition to those parts shown in Fig. 5. 
[0703] The input unit 1 1 7 is used to input various data 
or commands. 

[0704] The display unit 131 serves to display various 
kinds of information, data or operation guides thereby 
presenting the information to the human user or prompt- 
ing the user to perform an operation. 
[0705] The judgment unit 130 judges the status re- 
garding the playback operations performed in the past, 
on the basis of the additional information or flags stored 
in the playback card 8 received from the movie theater 
502 or by communication with the bank center 550. In 
accordance with the result of the judgment made by the 
judgment unit 130, the distribution controller 112 con- 
trols the data distribution and the authentication/write 
controller 1 06 controls the operation of writing the addi- 
tional information into the playback card 8. 
[0706] The relay server ID storage unit 1 07 stores not 
only the relay server ID but also the playback card IDs 
which serves as identifiers of the respective playback 
cards 8 used by the respective movie theaters 502 (play- 
back apparatuses 3). 

[0707] Recording the playback card ID in the playback 



card 8 allows the relay server 2 to identify the corre- 
sponding playback apparatus 3 by detecting the play- 
back card ID recorded in the playback card 8. This also 
makes it possible to produce a playback card 8. 

5 

[E(7)] Configuration of Playback Apparatus 

[0708] The construction of the playback apparatus 3 
is similar to that shown in Fig. 6 except that the playback 
10 card 8 is employed as the card connected to the card 
interface 21 1 . 

[F(7)] Process Performed by Server 

is [0709] The process performed by the server 1 is sim- 
ilar to that shown in Fig. 7. However, information (such 
as a flag) of a large number of playback card 8 is record- 
ed in each delivery card 4 wherein flags are recorded in 
correspondence with playback IDs. Therefore, when a 
returned delivery card 4 is checked in steps F1 8 to F23, 
flags are examined to detect the status of the playback 
apparatuses 3 corresponding to the respective playback 
card IDS. 



[0710] Figs. 37 and 38 illustrate the process per- 
formed by the relay server 2. In these figures, similar 
steps to those shown in Fig. 8 are denoted by similar 
30 step numbers, and they are not described in further de- 
tail herein. 

[071 1 ] Reception of encrypted content data and addi- 
tional information from the sever 1 is performed in steps 
F31 to F35 in a similar manner as described above with 

35 reference to Fig. 8. 

[0712] In step F36, it is checked whether a delivery 
card 4 received from the server 1 is inserted. If no in- 
serted delivery card is detected, the process proceeds 
to step F501 to display, on the display unit 131 , a mes- 

40 sage to ask a human operator to insert a delivery card 
4. If, in response to the message, the operator inserts a 
delivery card 4 within a predetermined period of time, 
the process returns to step F36. However, if no delivery 
card 4 is inserted within the predetermined period of 

45 time, the process jumps to step F49 shown in Fig. 38. 
[0713] If it is determined in step F36 that an inserted 
delivery card 4 is detected, the decryption key DK1 
stored in the delivery card 4 is decrypted and then the 
additional information is decrypted using the decryption 

so key DK1 in steps F37 to F39, in a similar manner as 
described above with reference to Fig. 8. 
[0714] Thereafter, in step F503, it is checked whether 
a playback card 8 is inserted. If no inserted playback 
card 8 is detected, the process proceeds to step F504 

55 to display, on the display unit 1 31 , a message to ask a 
human operator to insert a playback card 8. If, in re- 
sponse to the message, the operator inserts a playback 
card 8 within a predetermined period of time (for exam- 
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pie, if the delivery card 4 is replaced with a playback 
card 8), the process returns to F503. However, if no play- 
back card 8 is inserted within the predetermined period 
of time, the process jumps to step F49 shown in Fig. 38. 
[0715] If an inserted playback card 8 is detected in 
step F503 ; the additional information is decrypted in 
steps F506 to F508 in a similar manner to the delivery 
card 4. 

[0716] That is, in step F506, decryption key DK1 and 
the additional information (and various flags) encrypted 
using the encryption key AK2 are read from the playback 
card 8. 

[0717] In step F507, the decryption key DK1 is de- 
crypted using the decryption key DK2 generated by the 
key generator 104. 

[0718] In step F508, the additional information and 
flags encrypted using the encryption key AK1 are de- 
crypted using the decryption key DK1 . 
[0719] In this process, the playback card ID is also 
read. 

[0720] In step F509 : the authentication/write control- 
ler 1 06 checks whether the information read from the 
playback card 8 includes a deletion-from-playback-ap- 
paratus flag indicating that the content data stored in the 
playback apparatus 3 has been deleted. If such a dele- 
tion-from-playback-apparatus flag is not detected, the 
process proceeds to step F49. 

[0721] If the deletion-from-playback-apparatus flag 
indicating that the content data stored in the playback 
apparatus 3 has been deleted is detected, the process 
proceeds to step F51 0. In step F51 0, the judgment unit 
130 communicates with the bank center 550 to check 
the status regarding the payment. 
[0722] More specifically, the judgment unit 130 
checks whether the movie theater 502 having the play- 
back apparatus indicated by the playback card ID has 
correctly paid the fee for the content data which was de- 
livered to the movie theater 502 in the past. 
[0723] If it is determined that payment has been cor- 
rectly performed, the process proceeds from step F511 
to F51 2. However, it is determined that payment has not 
been correctly performed, the process jumps from F51 1 
to F49. 

[0724] Herein, it is assumed that the movie theater 
502 is required to pay the fee for the movie which has 
been already played. Alternatively, the movie theater 
502 may pay the fee for a movie which will be received 
next (and will be played). 

[0725] If it is determined that the movie theater 502 
has paid the fee for the content data which was trans- 
mitted in the past, then in step F512 it is determined 
which content data is to be transmitted next. That is, the 
schedule information is examined which is included in 
the additional information received from the server 1 or 
read from the delivery card 4. If it is determined that 
there is a content data to be transmitted at the present 
time, the process proceeds to step F513 to transmit the 
content data. However, no content data to be transmit- 



ted at the present time is detected, the process pro- 
ceeds to step F49. 

[0726] In the case where content data to be transmit- 
ted at the present time is detected, the process pro- 
5 ceedsto step F513. In step F513, the database control- 
ler 113 retrieves, under the control of the distribution 
controller 112, the content data to be transmitted from 
the compressed data stored unit 109. 
[0727] In step F514, the encrypted content data and 
10 the associated additional information which have been 
retrieved are modulated by the modulator 114. 
[0728] In parallel, in step F515, information such as 
the additional information read from the delivery card 4 
is written into the playback card 8. More specifically, un- 
15 derthe control of the authentication/write controller 1 06, 
the encryption unit 1 1 6 encrypts the decryption key DK1 
read from the delivery card 4 and transmits the encrypt- 
ed decryption key DK1 to the card read/write controller 
105. Furthermore, the encryption unit 116 encrypts the 
20 additional information including the content ID, the des- 
tination identifiers ID1 and ID2, and the schedule infor- 
mation using the encryption key AK1 and transmits the 
encrypted additional information to the card read/write 
controller 1 05. The card read/write controller 1 05 writes 
25 them into the playback card 8. 

[0729] In step F516, the encrypted content data and 
additional information, which have been modulated in 
step F514 by the modulator 114 after being read from 
the compressed data storage unit 109, are transmitted 
30 from the transmitting unit 1 1 5 to the playback apparatus 
3. Furthermore, the playback card 8 including the de- 
cryption key DK1 and the additional information written 
therein in step F515 is sent to the movie theater 502. 
[0730] In the process described above, transmission 
of the content data to the playback apparatus 3 is per- 
formed in steps F512 to F516 only if the defetion-from- 
playback-apparatus flag written in the playback card 8 
indicates that the content data which was used in the 
past has been deleted from the playback apparatus 3 
and if the checking of the account indicates that pay- 
ment has been correctly performed. That is, transmis- 
sion of the content data is performed only if it is deter- 
mined that content data has been dealt with correctly 
and also payment has been made correctly by the play- 
back apparatus 3. 

[0731] Although the process of writing data into the 
delivery card 4 to be returned to the server 1 is not 
shown in the flow charts in Figs. 38 and 39, the flags 
stored in the playback card 8 received from each movie 
theater 502 are written together with the playback card 
ID into the delivery card 4 at a proper time after reading 
the data from the playback card 8. This allows the server 
1 to perform the checking process in steps F18 to F23 
shown in Fig. 7 when the server 1 receives the delivery 
card 4. 

[0732] When the check of whether the playback card 
8 is inserted is performed in step F503, authentication 
of the human operator may be performed to confirm that 
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the human operator who is now operating the playback 
apparatus 3 is an authorized operator. Authentication 
may be performed by asking the operator to input his/ 
her personal ID and/or password, and verifying the input 
data. 

[0733] To this end : it is required that a user ID or a 
password for identifying an authorize operator be stored 
in the playback card 8 or the storage unit 110. 
[0734] Preferably, to prevent production of a replica 
of the playback card 8 or the delivery card 4, the addi- 
tional information stored in the storage unit 110 is pre- 
vented from being read out unless authentication is suc- 
cessfully passed. 

[0735] Furthermore, the playback ID recorded in the 
playback card 8 may be prevented from being read out 
unless authentication is successfully passed. 

[H(7)l Process Performed by Playback Apparatus 

[0736] Fig. 39 illustrates the process performed by the 

playback apparatus 3. The process shown in Fig. 39 is 

basically the same as that shown in Fig. 9. 

[0737] However, the card dealt with in steps F57 to 

F61 . F71 . and F74 arc replaced with the playback card 

8 

[0738] In the case where a playback command is de- 
tected in stop F56 : steps F57 to F61 are performed to 
fond information such as the additional information from 
tnc playback card 8. Thereafter, in step F520, it is de- 
tcmincd whether to permit a playback operation. In this 
process in step F520, it is checked whether the addi- 
licna information read from the playback card 8 is iden- 
tical to the additional information which is retained in the 
storage unit 209 after being received via electronic 
trnnsmisstcn: whether the present time is within the al- 
lowed playing period indicated by the schedule informa- 
tion included in the additional information; and whether 
the playoack card ID is identical to (or consistent with) 
the playback apparatus ID. Only when the above re- 
quirements are all satisfied, it is determined that the 
playback operation should be permitted, and the proc- 
ess can proceed to step F64 and further to step F65 to 
perform the playback operation. 

[I(7)| Advantages 

[0739] The configuration and the operation according 
to the seventh embodiment of the present invention pro- 
vide the advantages described below in addition to the 
advantages (1 ) to (8) described earlier with reference to 
the first embodiment. 

[0740] (20) When a relay server 2 receives a playback 
card 8 : the relay server 2 checks whether content data 
transmitted in the past has been correctly deleted and/ 
or whether payment has been correctly performed. Only 
if the answer to the check is affirmative, next content 
data is transmitted. This ensures that the movie theater 
502 obeys the contract. 
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[0741] (21) In a system in which a delivery card 4 is 
delivered between a server 1 and a relay server 2, and 
a playback card 8 is delivered between the relay server 
2 and a playback apparatus 3, it becomes possible to 
5 easily deliver cards and easily manage the delivery 
compared with a system in which the delivery card 4 is 
delivered to a movie theater 502, although the advan- 
tage of the system depends upon the scale of the sys- 
tem or the number of relay servers and playback appa- 
ratuses. 

Eighth Embodiment 
[A(8)] Outline 

[0742] The outline of a movie distribution system ac- 
cording to an eighth embodiment of the present inven- 
tion is described below with reference to Fig. 40. 
[0743] In this eighth embodiment, a server 1 does not 
distribute content data by means of transmission but the 
server 1 delivers a movie film 5, which has been edited 
after being shot, to respective movie distribution com- 
panies 501 . 

[0744] As in the seventh embodiment, the server 1 
produces as many delivery cards 4 as required, and the 
server 1 sends the delivery cards 4 to the respective 
movie distribution companies 501 in parallel with or to- 
gether with the films 5. 

[0745] In each movie distribution company 501 , a re- 
lay server 2 receives a film 5 and a delivery card 4 sent 
from the server 1 . The movie recorded on the film 5 is 
converted into the form of content data 6 so that it can 
be transmitted. 

[0746] The relay server 2 transmits the encrypted 
content data 6 and associated additional information to 
each movie theater 502. Furthermore, the relay sever 2 
sends the playback card 8 produced on the basis of the 
delivery card 4 to each movie theater 502. 
[0747] The playback apparatus 3 in each movie theat- 
er 502 receives the content data 6 and the associated 
additional information. The playback apparatus 3 also 
reads various kinds of information such as the additional 
information stored on the received playback card 8. Fur- 
thermore, using the key read from the playback card 8, 
the encrypted content data and additional information 
are decrypted. Thereafter, the content data is played 
back in accordance with the additional information read 
from the playback card 8 and the additional information 
received via electronic transmission. 
[0748] In each movie theater 502, when the predeter- 
mined playing period has expired, the content data 6 
stored in the playback apparatus 3 is deleted, and a de- 
lete flag is written into the playback card 8 to indicate 
that the content data 6 has been deleted from the play- 
back apparatus 3. 

[0749] The playback card B is then sent to the relay 
server 2 and updated so that another content data can 
be received. The information such as flags recorded in 
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the playback card 8 is recorded into the delivery card 4. 
Thereafter, the delivery card 4 is sent to the movie pro- 
duction company 500. 

[0750] On the basis of the information stored on the 
collected delivery cards A, the server 1 checks whether 
the distributed content data 6 has been used adequate- 
ly- 

[B(8)] Configuration of Server 

[0751] The configuration of the server 1 is similar to 
that shown in Fig. 11 . 

[C(8)J Configuration of Card 

[0752] The configuration of the delivery card 4 and 
that of the playback card 8 are similar to those shown 
in Figs. 35A and 35B, respectively. 

[D(8)] Configuration of Relay Server 

[0753] Fig. 41 illustrates a configuration of the relay 
server 2. As shown in Fig. 41 , the relay server 2 includes 
a judgment unit 130 and a display unit 131 , in addition 
to those parts shown in Fig. 12. 

[0754] The input unit 1 1 7 is used, as described earlier 
with reference to Fig. 12, to input additional information 
and other necessary data or commands when content 
data is produced from a film 5. 

[0755] The display unit 131 serves to display various 
kinds of information, data or operation guides thereby 
presenting the information to the human user or prompt- 
ing the user to perform an operation. 
[0756] The judgment unit 130 judges the status re- 
garding the playback operations performed in the past, 
on the basis of the additional information or flags stored 
in the playback card 8 received from the movie theater 
502 or by communication with the bank center 550. In 
accordance with the result of the judgment made by the 
judgment unit 130, the distribution controller 112 con- 
trols the data distribution and the authentication/write 
controller 106 controls the operation of writing the addi- 
tional information into the playback card 8. 
[0757] The relay server ID storage unit 1 07 stores not 
only the relay server ID but also the playback card IDs 
which serves as identifiers of the respective playback 
cards 8 used by the respective movie theaters 502 (play- 
back apparatuses 3). 

[0758] Recording the playback card ID in the playback 
card 8 allows the relay server 2 to identify the corre- 
sponding playback apparatus 3 by detecting the play- 
back card ID recorded in the playback card 8. This also 
makes it possible to produce a playback card 8. 

[E(8)] Configuration of Playback Apparatus 

[0759] The construction of the playback apparatus 3 
is similar to that shown in Fig. 6 except that the playback 
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card 8 is employed as the card connected to the card 
interface 211 . 

[F(8)] Process Performed by Server 

5 

[0760] The process performed by the server 1 is sim- 
ilar to that shown in Fig. 13. However, information (such 
as a flag) of a large number of playbackcard 8 is record- 
ed in each delivery card 4 wherein flags are recorded in 
10 correspondence with playback IDs. Therefore, when a 
returned delivery card 4 is checked in steps F113 to 
F1 1 8, flags are examined to detect the status of the play- 
back apparatuses 3 corresponding to the respective 
playback card IDs. 

15 

[G(8)] Process Performed by Relay Server 

[0761] Figs. 42A and 42B illustrate the process per- 
formed by the relay server 2. In Figs. 42A and42B,sim- 
20 j|ar steps to those shown in Fig. 1 4 are denoted by sim- 
ilar step numbers, and they are not described in further 
detail herein. 

[0762] The process of producing content data from 
the film 5 received from the server 1 is performed in 
25 steps F121 to F125 in a similar manner as described 
above with reference to Fig. 14. 

[0763] In step F126, it is checked whether a delivery 
card 4 received from the server 1 is inserted. If no in- 
serted delivery card is detected, the process proceeds 

30 to step F501 to display, on the display unit 131 , a mes- 
sage to ask a human operator to insert a delivery card 
4. Thereafter, the process returns to step F126. 
[0764] If an inserted delivery card 4 is detected in step 
F126, the decryption key DK1 stored in the delivery card 

35 4 is decrypted and then the additional information is de- 
crypted using the decryption key DK1 in steps F127to 
F129, in a similar manner as described above with ref- 
erence to Fig. 8. Furthermore, it is judged whether the 
additional information is valid. 

40 [0765] More specifically, using for example the con- 
tent ID as a retrieval key, the authentication/write con- 
troller 106 retrieves additional information which is re- 
tained in the storage unit 110 after being input via the 
input unit 11 7 to judge whether there is stored additional 

45 information which is identical to the additional informa- 
tion read from the delivery card 4. 
[0766] If identical additional information is not found, 
it is determined that the currently inserted delivery card 
4 is not one associated with content data existing at this 

so point of time in the compressed data storage unit 109, 
that is, it is determined that the delivery card 4 is not one 
associated with content data which is to be transmitted 
or was transmitted in the past to the movie theaters 502. 
In this case, the process proceeds to step F142 without 

55 doing anything. 

[0767] If the additional information is determined as 
being valid, then in the next step F503 it is checked 
whether a playback card 8 is inserted. If no inserted 
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playback card 8 is detected, the process proceeds to 
step F504 to display, on the display unit 1 31 , a message 
to ask a human operator to insert a playback card 8. 
Thereafter, the process returns to step F503. 
[0768] If an inserted playback card 8 is detected In 
step F503, the additional information is decrypted in 
steps F506, F507 ; and F520 in a similar manner to the 
delivery card 4. 

[0769] That is, in step F506, decryption key DK1 and 
the additional information (and various flags) encrypted 
using the encryption key AK2 are read from the playback 
card 8. 

[0770] in step F507, the decryption key DK1 is de- 
crypted using the decryption key DK2 generated by the 
key generator 104. 

[0771] In step F508, the additional information and 
flags encrypted using the encryption key AK1 are de- 
crypted using the decryption key DK1 . In this process, 
the playback card ID is also read. Furthermore, it is 
judged whether the decrypted additional information is 
valid. 

[0772] That is, using for example the content ID as a 
retrieval key : the authentication/write controller 106 re- 
trieves additional information stored in the storage unit 
1 1 0 to judge whether there is stored additional informa- 
tion which is identical to the additional information read 
from the playback key 8. 

[0773] If identical additional information is not found, 
it is determined that the currently inserted playback card 
8 is not one associated with content data existing at this 
point of time in the compressed data storage unit 109, 
that is. it is determined that the playback card 8 is not 
one associated with content data which was transmitted 
in the past to the movie theaters 502. In this case, the 
process proceeds to step F142 without doing anything. 
[0774] On the other hand, if identical additional infor- 
mation is detected, the process proceeds to step F509 
in which the authentication/write controller 106 checks 
whether the information read from the playback card 8 
includes a deletion-from-playback-apparatus flag indi- 
cating that the content data stored in the playback ap- 
paratus 3 has been deleted. If such a deletion-from- 
playback-apparatus flag is not detected, the process 
proceeds to step F142. 

[0775] if the deletion-from-playback-apparatus flag 
indicating that the content data stored in the playback 
apparatus 3 has been deleted is detected, the process 
proceeds to step F510. In step F510, the judgment unit 
130 communicates with the bank center 550 to check 
the status regarding the payment. 
[0776] More specifically, the judgment unit 130 
checks whether the movie theater 502 having the play- 
back apparatus indicated by the playback card ID has 
correctly paid the fee for the content data which was de- 
livered to the movie theater 502 in the past. 
[0777] If it is determined that payment has been cor- 
rectly performed, the process proceeds from step F51 1 
to F51 2. However, it is determined that payment has not 



been correctly performed, the process jumps from F511 
to F142. 

[0778] Herein, it is assumed that the movie theater 
502 is required to pay the fee for the movie which has 
5 been already played. Alternatively, the movie theater 
502 may pay the fee for a movie which will be received 
next (and will be played). 

[0779] If it is determined that the movie theater 502 
has paid the fee for the content data which was trans- 

10 mitted in the past, then in step F512 it is determined 
which content data is to be transmitted next. That is, the 
schedule information is examined which is included in 
the additional information received from the server 1 or 
read from the delivery card 4. If it is determined that 

is there is a content data to be transmitted at the present 
time, the process proceeds to step F513 to transmit the 
content data. However, no content data to be transmit- 
ted at the present time is detected, the process pro- 
ceeds to step F142. 

20 [0780] In the case where content data to be transmit- 
ted at the present time is detected, the process pro- 
ceeds to step F513. In step F513, the database control- 
ler 113 retrieves, under the control of the distribution 
controller 112, the content data to be transmitted from 

25 the compressed data stored unit 109. 

[0781] In step F514, the encrypted content data and 
the associated additional information which have been 
retrieved are modulated by the modulator 114. 
[0782] In parallel, in step F515, information such as 

30 the additional information read from the delivery card 4 
is written into the playback card 8. More specifically, un- 
der the control of the authentication/write controller 1 06, 
the encryption unit 11 6 encrypts the decryption key DK1 
read from the delivery card 4 and transmits the encrypt- 

35 ed decryption key DK1 to the card read/write controller 
105. Furthermore, the encryption unit 116 encrypts the 
additional information including the content ID, the des- 
tination identifiers ID1 and ID2, and the schedule infor- 
mation using the encryption key AK1 and transmits the 

^0 encrypted additional information to the card read/write 
controller 1 05. The card read/write controller 1 05 writes 
them into the playback card 8. 

[0783] In step F516, the encrypted content data and 
additional information, which have been modulated in 

45 step F514 by the modulator 114 after being read from 
the compressed data storage unit 109, are transmitted 
from the transmitting unit 1 1 5 to the playback apparatus 
3. Furthermore, the playback card 8 including the de- 
cryption key DK1 and the additional information written 

50 therein in step F515 is sent to the movie theater 502. 
[0784] In the process described above, as in the sev- 
enth embodiment described above, transmission of the 
content data to the playback apparatus 3 is performed 
in steps F512to F516 only if thedeletion-from-piayback- 

5 5 apparatus flag written in the playback card 8 indicates 
that the content data which was used in the past has 
been deleted from the playback apparatus 3 and if the 
checking of the account indicates that payment has 
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been correctly performed. That is, transmission of the 
content data is performed only if it is determined that 
content data has been dealt with correctly and also pay- 
ment has been made correctly by the playback appara- 
tus 3. 

[0785] Although the process of writing data into the 
delivery card 4 to be returned to the server 1 is not 
shown in the flow charts shown in Figs. 42A and 42B, 
the flags stored in the playback card 8 received from 
each movie theater 502 are written together with the 
playback card ID into the delivery card 4 at a proper time 
after reading the data from the playback card 8. This 
allows the server 1 to perform the checking process in 
steps F113 to F118 shown in Fig. 13 when the server 1 
receives the delivery card 4. 

[0786] As is described above with reference to the 
seventh embodiment, when the check of whether the 
playback. card 8 is inserted is performed in step F503, 
authentication of the human operator may be performed 
to confirm that the human operator who is now operating 
the playback apparatus 3 is an authorized operator. Au- 
thentication may be performed by asking the operator 
to input his/her personal ID and/or password, and veri- 
fying the input data. 

[0787] To prevent production of a replica of the play- 
back card 8 or the delivery card 4, the additional infor- 
mation stored in the storage unit 110 is prevented from 
bring road out unless authentication is successfully 
passed Furthermore, the playback ID recorded in the 
playback card 8 may be prevented from being read out 
urloss authentication is successfully passed. 

|H(8)| Process Performed by Playback Apparatus 

[0788] The process performed by the playback appa- 
ratus 3 is similar to that shown in Fig. 39. 

|l(8)| Advantages 

[0789] As with the seventh embodiment described 
above tne eighth embodiment provides advantages (1) 
to (8) and advantages (20) and (21). 

Ninth Embodiment 

[A(9)| Outline 

[0790] A ninth embodiment is described below. 
[0791] The configuration and the operation of the 
ninth embodiment are based on the eighth embodiment 
described above, and the flows of the content data 6, 
the delivery card 4, and the playback card 8 are similar 
to those shown in Fig. 40. 

[0792] However, the difference is that the additional 
information transmitted and the additional information 
recorded in the playback card 8 further include a 
number-of-times value indicating the number of times 
content data is allowed to be played back by the play- 
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back apparatus 3 of the movie theater 502 to play a mov- 
ie. 

[0793] In the ninth embodiment, the number of times 
the playback apparatus 3 is allowed to play back the re- 
ceived content data is limited to the number-of-times 
value described in the corresponding additional infor- 
mation. If a playback command is further issued after 
the content data has been played back as many times 
as allowed, the commanded playback operation is not 
executed. 

[0794] The number-of-times value indicating the 
number of times the content data is allowed to be played 
back is set by the movie production company 500 or the 
movie distribution company 501 in accordance with the 
agreement between the movie theater 502 and the mov- 
ie production company 500 or the movie distribution 
company 501. 

[0795] Although not described in detail, a watermark 
may be embedded in the content data as in the third 
embodiment described below. 

[0796] In this case, the relay server 2 embeds a PN 
code indicating that the content data is permitted to be 
played back into the content data. In the playback ap- 
paratus 3, when the content data has been played back 
as many times as permitted, the watermark is rewritten 
into a PN code which disables the content data to be 
played back. 

[B(9)] Configuration of Server 

[0797] The configuration of the server 1 is similar to 
that shown in Fig. 11. 

[C(9)] Configuration of Card 

[0798] Figs. 43A and 43B illustrate the configurations 
of the delivery card 4 and the playback card 8, respec- 
tively. These are basically similar to those shown in Figs. 
35A and 35B, respectively. However, the difference is 
that the number of times the content data is allowed to 
be played back is added to the additional information 
which is written in an encrypted form into the memory 
83 of the playback card 8. 

[0799] In the present embodiment, the number of 
times the content data is allowed to be played back is 
set by the relay server 2, and thus the number of times 
the content data is allowed to be played back is not de- 
scribed in the delivery card 4. Alternatively, the number 
of times the content data is allowed to be played back 
may be set by the server 1 . In this case, the number of 
times the content data is allowed to be played back is 
recorded in the delivery card 4 and delivered to the relay 
server 2. - 

[D(9)] Configuration of Relay Server 

[0800] The relay server 2 has a similar configuration 
to that shown in Fig. 41 . However, the difference is that 
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the additional information input via the input unit 117, 
the additional information written in the playback card 8, 
the additional information stored in the storage unit 1 1 0. 
and the additional information which is stored together 
with the content data in the compressed data storage 5 
unit 109 and which is transmitted to the movie theater 
502 all includes the number of times the content data is 
allowed to be played back. 

[E(9)] Configuration of Playback Apparatus 10 

[0B01] Fig. 44 illustrates the structure of the playback 
apparatus 3. As shown in Fig. 44, the playback appara- 
tus 3 includes a maximum playback number detection/ 
write controller 230. 15 
[0802] A number-of-times value indicating the 
number of times content data is allowed to be played 
back is included in additional information which is de- 
modulated and decrypted after being received by the re- 
ceiving unit 201, additional information which is read 20 
from the delivery card 4 and then decrypted, additional 
information stored in the storage unit 209, and additional 
information which is stored together with content data 
in the compressed data storage unit 208. 
[0803] The maximum playback number detection/ 25 
write controller 230 detects the number-of-times value 
indicating the number of times the content data is al- 
lowed to be played back, from the additional information 
corresponding to the content data to be played back. On 
the basis of the detected value, the maximum playback 30 
number detection/write controller 230 determines 
whether to permit the content data to be played back. 
[0804] Each time the content data is played back, the 
number-of-times value indicating the number of times 
the content data is allowed to be played back is decre- 35 
mented under the control of the maximum playback 
number detection/write controller 230. More specifically, 
each time the content data is played back, the number- 
of-times value which indicates the number of times the 
content data is allowed to be played back and which is *o 
included in the additional information stored in the stor- 
age unit 209 and also in the playback card 8 is decre- 
mented by one. 

[F(9)] Process Performed by Server 45 

[0805] The process performed by the server 1 is sim- 
ilar to that shown in Fig. 13. However, information (such 
as a flag) of a large number of playback card 8 is record- 
ed in each delivery card 4 wherein flags are recorded in 50 
correspondence with playback IDs. Therefore, when a 
returned delivery card 4 is checked in steps F113 to 
F1 1 8, flags are examined to detect the status of the play- 
back apparatuses 3 corresponding to the respective ' 
playback card IDS. 55 
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[G(9)] Process Performed by Relay Server 

[0806] Figs. 45 and 46 illustrate the process per- 
formed by the relay server 2. In Figs. 45 and 46, similar 
steps to those shown in Fig. 14 or Fig. 42 A or 42B are 
denoted by similar step numbers, and they are not de- 
scribed in further detail herein. 

[0807] More specifically, steps F121 to F509 shown 
in Fig. 45 are similar to those shown in Fig. 42A. Fur- 
thermore, steps F510 to F512 and steps F513 to F516 
shown in Fig. 46 are similar to those shown in Fig. 42B. 
[0808] However, the process according to the ninth 
embodiment is different from that shown in Figs. 42A 
and 42B in that the playback condition of the delivered 
content data is set in step F601 shown in Fig. 46. 
[0809] Also in the process described above, as in the 
seventh and eighth embodiments described above, 
transmission of the content data to the playback appa- 
ratus 3 is performed in steps F512 to F516 only if the 
deletion-from-playback-apparatus flag written in the 
playback card 8 indicates that the content data which 
was used in the past has been deleted from the playback 
apparatus 3 and if the checking of the account indicates 
that payment has been correctly performed. In the 
above transmission process, the playback condition is 
set in step F601 . 

[0810] In this case, the number of times the content 
data is allowed to be played back is set as the playback 
condition. More specifically, for example, the authenti- 
cation/write controller 1 06 sets the number of times the 
content data is allowed to be played back in accordance 
with the contract! The resultant value is added to the 
additional information. 

[0811] As a result, the additional information which is 
modulated in step F514 and then transmitted in step 
F516 together with the content data and also the addi- 
tional information which is written in step F515 into the 
playback card 8 both includes the number of times the 
content data is allowed to be played back. 
[081 2] Because the number of times the playback ap- 
paratus 3 can play back the content data is limited to the 
above-described value, the checking in step F510 is 
performed as to whether the fee for the previous content 
data has been correctly paid. 

[H(9)] Process Performed by Playback Apparatus 

[0813] Fig. 47 illustrates the process performed by the 
playback apparatus 3. In Fig. 51 , similar steps to those 
shown in Fig. 39 or Fig. 9 are denoted by similar step 
numbers, and they are not described in further detail 
herein. 

[0814] In the process shown in Fig. 47, as in the proc- 
ess described above with reference to Fig. 39, when a 
playback command is detected in step F56, steps F57 
to F61 are performed to read information such as the 
additional information from the playback card 8. There- 
after, in step F520, it is determined whether to permit a 
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playback operation. In this process in step F520, it is 
checked whether the additional information read from 
the playback card 8 is identical to the additional infor- 
mation which is retained in the storage unit 209 after 
being received via electronic transmission; whether the 
present time is within the allowed playing period indicat- 
ed by the schedule information included in the additional 
information; and whether the playback card ID is iden- 
tical to (or consistent with) the playback apparatus ID. 
Only when the above requirements are ail satisfied, the 
process can proceed to step F64 to perform the play- 
back operation. 

[0815] However, after retrieving the content data in 
step F64, the process proceeds to step F610 in which 
the maximum playback number detection/write control- 
ler 230 detects the number-of -times value indicating the 
number of times the content data is allowed to be played 
back, from the corresponding additional information.. 
[0816] If it is determined in step F61 1 that the number 
of times the content data is allowed to be played back 
is not equal to 0 , it is determined that the specified con- 
tent data is allowed to be further played back. 
[0817] In this case : the process proceeds to step F612 
in which the number-of-times value described in the ad- 
ditional information is decremented by 1 under the con- 
trol of the maximum playback number detection/write 
controller 230. More specifically, the number-of-times 
value described in the additional information stored in 
the storage unit 209 and also the number-of-times value 
described in the additional information stored in the 
compressed data storage unit 208 are decremented, 
and the authentication/write/delete controller 206 trans- 
mits the additional information including the decrement- 
ed number-of-times value to the card read/write control- 
ler 205 via the encryption unit 220. The card read/write 
controller 205 updates the additional information record- 
ed in the playback card 8 in accordance with the re- 
ceived additional information. 

[0818] In step F65, the content data is played back. 
[0619] Because each time the content data is played 
back, the number-of-times value indicating the number 
of times the content data is allowed to be played back 
is decremented, if a playback command is issued after 
the content data has been played back as many times 
as the original number-of-times value which was set by 
the relay server 2, it is determined in step F611 that the 
number-of-times value indicating the number of times 
the content data is allowed to be played back is equal 
to 0, and thus the process can no longer proceed to step 
F65 to further play back the content data. 
[0620] Inthiscase.theprocessproceedstostep F613 
to display a warning on the display unit 21 3. Then in step 
F68, the content data is deleted. 

[0821] That is, in the present embodiment, even when 
no command issued by the human operator is detected 
in step F67, the content data is deleted from the com- 
pressed data storage unit 208 when the content data 
has been played back as many times as allowed. 



[0822] In the present embodiment, the movie theater 
502 pays the fee to the relay server 2 or the server 1 , 
depending upon the original number-of-times value 
which is set by the relay server 2 so as to indicate the 

5 number of times the content is allowed to be played 
back. That is : in the payment process in steps F72 to 
F74, the amount of money to be paid is determined ac- 
cording to the number-of-times value indicating the 
number of times the content data is allowed to be played 

10 back, which is detected a first time after the additional 
information was received (or after the additional infor- 
mation was read from the playback card 8). 
[0823] In the present embodiment, the decrementing 
of the number of times the content data is allowed to be 

*5 played back is performed in step F612 for all the addi- 
tional information stored in the storage unit 209, that 
stored in the compressed data storage unit 208, and that 
stored in the playback card 8. However, in the case 
where the number of times the content data is allowed 
20 to be played back is not required to be determined as 
being identical in the judgment in step F520, the decre- 
menting may be performed only for the additional infor- 
mation recorded in the playback card 8, or for the addi- 
tional information stored in the storage unit 209 or com- 
25 pressed data storage unit 208. Of course, in this case, 
the detection of the number of times the content data is 
allowed to be played back in step F610 must be per- 
formed for the additional information that is subjected to 
the decrementing. 

30 

[l(9)] Advantages 

[0824] As with the seventh and eighth embodiments 
described above, the ninth embodiment provides ad- 

35 vantages (1 ) to (8) and advantages (20) and (21 ). In ad- 
dition, the following advantages are obtained. 
[0825] (22) The relay sever 2 (or the server 1) can 
control the number of times the content data is played 
back by the playback apparatus 3 by describing, in the 

40 additional information, the number of times the content 
data is allowed to be played back. The number of times 
the content data is allowed to be played back can be 
defined in the contract. 

[0826] (23) By charging the fee in accordance with the 
45 original number-of-times value indicating the number of 
times the content data is allowed to be played back, it 
is possible to correctly and clearly charge the fee in the 
movie delivery system. Furthermore, it is possible to 
control the number of times the content data is allowed 
50 to be played back, depending upon the payment status. 
[0827] (24) When the content data has been played 
back as many times as allowed, the content data is de- 
leted from the playback apparatus 3 without waiting fcr 
a delete command. This prevents the content data from 
55 being copied to another playback apparatus or the like. 
This ensures that the content data is managed strictly. 
[0828] (25) The number of times the content data is 
allowed to be played back, which is described in the 
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playback card 8, is decremented each time the content 
data is piayed back. Therefore, when the playback card 
8 is returned to the relayserver 2. the relay server 2 can 
detect the number of times the content data has actually 
been played back in the movie theater 502 by checking 
the value of the number of times the content data is al- 
lowed to be played back, which is described in the play- 
back card 8 . This is useful for management and for field 
investigation of the playing status. 
[0829] This can also be used to realize a system in 
which a fee is charged not on a prepayment basis, but 
the number of times the content data has actually been 
played back is detected from the data described in the 
playback card 8 returned to the relay server 2 and a fee 
corresponding to the detected number of times the con- 
tent data has actually been played back is charged. In 
this case, the number of times the content data is al- 
lowed to be played back is limited to a predetermined 
value. 

Tenth Embodiment 
[A(10)J Outline 

[0830] A tenth embodiment is described below. 
[0831] The configuration and the operation of the 
tenth embodiment are based on those of the eighth em- 
bodiment. Therefore, the flows of the content data 6, the 
delivery card 4, and the playback card 8 are similar to 
those shown in Fig. 40. 

[0832] However, the n umber of times the content data 
has been played back by the playback apparatus 3 of 
the movie theater 502 is added to the additional infor- 
mation recorded in the playback card 8 which is sent 
from the playback apparatus 3 to the relay server 2. 
[0833] In this tenth embodiment, as in the previous 
embodiments described above, the playback apparatus 
3 determines whether the received content data is al- 
lowed to be played back on the basis of the correspond- 
ing additional information. Each time the content data is 
played back, the count of the number of times the con- 
tent data has been played back is incremented, and the 
count value is written into the playback card 8. 
[0834] On the other hand, when the playback card 8 
is sent from the movie theater 502 to the relay server 2, 
the relay server 2 checks the count value recorded in 
the playback card 8 to determine how many times the 
content data has been actually played back by the play- 
back apparatus 3. The relay server 2 further checks 
whether payment corresponding to the count value has 
been correctly made. 

[B(10)] Configuration of Server 

[0835] The configuration of the server 1 is similar to 
that shown in Fig. 11 . 



[C(10)] Configuration of Card 

[0836] Figs. 48A and 48B illustrate the configurations 
of the delivery card 4 and the playback card 8, respec- 
5 tively. The configurations are basically similar to those 
shown in Figs. 35A and 35B, respectively. However, the 
number of times the content data has been played back * 
is added to the additional information which is written in 
an encrypted form into the memory 83 of the playback 

10 card 8. Note that because the number of times the con- 
tent data has been played back is written by the play- 
back apparatus 3, the number of times the content data 
has been played back is not included in the additional 
information described in the playback card 8 when it is 

15 sent from the relay server 2 to the playback apparatus 
3 in parallel with the transmission of the content data. 
Alternatively, the count value is reset to 0 when the play- 
back card 8 is sent to the playback apparatus 3. 
[0837] In the present embodiment, the check on the 

20 number of times the content data has been played back 
is made by the relay sever 2. Therefore, it is not neces- 
sarily required that the number of times the content data 
has been played back be described in the delivery card 
4. However, when the delivery card 4 is returned from 

25 the relay server 2 to the server 1 , the relay server 2 may 
write the number of times the content data has been 
played back together with the playback card ID into the 
delivery card 4 in accordance with the count value de- 
tected from the playback card 8. This allows the server 

30 1 to detect the number of times the content data has 
been actually played back by each playback apparatus 
3. This is useful for management and for field investiga- 
tion of the playing status. 

35 [D(1 0)] Configuration of Relay Server 

[0838] The relay server 2 has a similar configuration 
to that shown in Fig. 41 . However, the difference is that 
the additional information read from the playback card 

40 8 received from the movie theater 502 includes the 
number of times the content data has been played back. 
The authentication/write controller 106 and the judg- 
ment unit 130 perform the process using the detected 
number of times the content data has been played back. 

4 5 [0839] Asforthe number of times the content data has 
been played back, which is included in the additional in- 
formation which is sent or transmitted to the playback 
apparatus 3, that is, the additional information written in 
the playback card 8 ; the additional information stored in 

50 the storage unit 110 after being input, the additional in- 
formation which is stored together with the content data 
in the compressed data storage unit 109 and which is 
transmitted to the movie theater 502, the count value 
may be set to 0. 

55 

[E(10)J Configuration of Playback Apparatus 

[0840] Fig. 49 illustrates the structure of the playback 
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apparatus 3. As shown in Fig. 49, the playback appara- 
tus 3 includes a playback counter value detection/write 
controller 231 , in addition to the parts shown in Fig. 6. 
[0841] The playback counter value detection/write 
controller 231 increments the playback counter value by 5 
one each time the content data is played back. 
[0842] Each time the playback counter value is incre- 
mented, the playback counter value included in the ad- 
ditional information recorded in the storage unit 209 and 
that recorded in the playback card 8 is updated under 10 
the control of the authentication/write/delete controller 
206. 

[F(1 0)] Process Performed by Server 

15 

[0843] The process performed by the server 1 is sim- 
ilar to that shown in Fig. 13. However, information (such 
as a flag) of a large number of playback cards 8 is re- 
corded in each delivery card 4 wherein flags are record- 
ed in correspondence with playback IDs. Therefore, 20 
when a returned delivery card 4 is checked in steps F113 
to F11 8, flags are examined to detect the status of the 
playback apparatuses 3 corresponding to the respective 
playback card IDS. 

[0844] If the playback counter value is recorded to- 25 
gether with the playback card ID, the determination of 
how many times the content data has been actually 
played back can be made for each playback apparatus 
3 on the basis of the playback counter value correspond- 
ing to the playback card ID. 30 

[G(10)] Process Performed by Relay Server 

[0845] Figs. 50A and 50B illustrate the process per- 
formed by the relay server 2. In Figs. 50A and 50B,sim- 35 
ilar steps to those shown in Fig. 14 or Fig. 42A or 42B 
are denoted by similar step numbers, and they are not 
described in further detail herein. 
[0B46] More specifically, steps F121 to F509 shown 
in Fig. 50A are similar to those shown in Fig. 42A. Fur- *o 
thermore, steps F51 1 to F51 6 shown in Fig. 50B are also 
similar to those shown in Fig. 42B. 
[0847] Also in this process shown in Figs. 50A and 
50B, as in the seventh and eighth embodiments de- 
scribed above, transmission of the content data to the «s 
playback apparatus 3 is performed in steps F512 to 
F51 6 only if the deletion-from-playback-apparatus flag 
written in the playback card 8 indicates that the content 
data which was used in the past has been deleted from 
the playback apparatus 3 and if the checking of the ac- so 
count indicates that payment has been correctly per- 
formed. However, the check on the payment in step 
F660 is performed differently. 

[0848] In step F660, the judgment unit 1 30 checks the 
account by communicating with the bank center 550. 55 
This checking process performed by the judgment unit 
130 is based on the playback counter value included in 
the additional information read from the playback card 



8 which is mounted on the relay server 2 after being re- 
ceived from the movie theater 502. 
[0849] That is ; in the movie distribution system ac- 
cording to the present embodiment, a fee is charged to 
the movie theater 502 on the basis of the playback coun- 
ter value. If the amount of money paid into the bank ac- 
count, detected by the judgment unit 130 in step F660, 
is equal to or greater than the value corresponding to 
the playback counter value, then in step F511 the judg- 
ment unit F550 makes an affirmative judgment. 

[H(10)J Process Performed by Playback Apparatus 

[0850] Fig. 51 illustrates the process performed by the 
playback apparatus 3. In Fig. 51 , similar steps to those 
shown in Fig. 39 or Fig. 9 are denoted by similar step 
numbers, and they are not described in further detail 
herein. 

[0851 ] In the process shown in Fig. 51 , as in the proc- 
ess shown in Fig. 39, if a playback command is detected 
in step F56, steps F57 to F61 are performed to read in- 
formation such as the additional information from the 
playback card 8. Thereafter, in step F520, it is deter- 
mined whether to permit a playback operation. In this 
process in step F520, it is checked whether the addi- 
tional information read from the playback card 8 is iden- 
tical to the additional information which is retained in the 
storage unit 209 after being received via electronic 
transmission; whether the present time is within the al- 
lowed playing period indicated by the schedule informa- 
tion included in the additional information; and whether 
the playback card ID is identical to (or consistent with) 
the playback apparatus ID. Only when the above re- 
quirements are all satisfied, it is determined that the 
playback operation should be permitted, and the proc- 
ess can proceed to step F64 to perform the playback 
operation. 

[0852] After retrieving the content data in step F64, 
the process proceeds to step F650 in which, under the 
control of the playback counter value detection/write 
controller 231, the playback counter value is detected 
from the additional information corresponding to the re- 
trieved content data, and the playback counter value is 
incremented by one. More specifically, in the addition 
information stored in the storage unit 209 and in the ad- 
ditional information stored in the compressed data stor- 
age unit 208, the playback counter value is incremented, 
and the authentication/write/delete controller 206 trans- 
mits the additional information including the increment- 
ed playback counter value to the card read/write con- 
troller 205 via the encryption unit 220. The card read/ 
write controller 205 updates the additional information 
recorded in the playback card 8 in accordance with the 
received additional information. 

[0853] In step F65, the content data is played back. 
[0854] In the above-described process, the playback 
counter value included in the additional information is 
counted so that it indicates the actual number of times 
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the content data has been played back. 
[0855] When the playback card 8 is sent to the relay 
server 2 after the end of the playing period, the relay 
server 2 checks, in step F660 in Fig. 50B, whether pay- 
ment corresponding to the playback counter value has 
been correctly made. 

[0856] In the present embodiment, the movie theater 
502 pays the charge corresponding to the number of 
times the content data has been actually played back, 
to the relay server 2 or the server 1 . Therefore, in the 
payment process in step F72 to F74, if payment is made 
by an amount corresponding to the playback counter 
value which is included in the additional information after 
completion of the deleting of the content data and the 
writing of the deletion-from-playback-apparatus flag in 
steps F67 to F71 . then the payment is correctly made. 
[0857] In the present embodiment, the incrementing 
of the playback counter value is performed in step F650 
for all the additional information stored in the storage 
unit 209 . that stored in the compressed data storage unit 
208, and that stored in the playback card 8. However, 
for example, the playback counter value recorded in the 
playback card 8 may not be updated each time the con- 
tent data is played back. In this case, when the deletion- 
f rom-playback-apparatus flag is written in step F71 , the 
additional information which is stored in the storage unit 
209 at that time and which thus includes the correct play- 
back counter value is written into the playback card 8. 

[1(10)] Advantages 

[0858] As with the seventh, eighth, and ninth embod- 
iments described above, the tenth embodiment pro- 
vides advantages (1) to (8) and advantages (20) and 
(21 ). In addition, the following advantages are obtained. 
[0859] (26) The relay serve 2 (or server 1) charges 
the fee on the basis of the playback counter value indi- 
cating the number of times the content data has been 
actually played back by the playback apparatus 3. This 
makes it possible for the movie theater 502 to pay the 
fee on the basis of the number of times the content data 
has been actually played back. This allows the movie 
theater 502 to play back the content data as many times 
as the movie theater 502 desires. Therefore, this movie 
distribution system is very useful also for the movie 
theater 502. 

[0860] (27) The relay server 2 or the server 1 can de- 
tect how many times the content data has been actually 
played back by the movie theater 502, from the playback 
counter value described in the playback card 8. This is 
useful for management and for field investigation of the 
playing status. 

Eleventh Embodiment 

[A(11)J Outline 

[0B61] An eleventh embodiment is described below. 
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[0862] The configuration and the operation of the 
eleventh embodiment are based on those of the eighth 
embodiment. Therefore, the flows of the content data 6, 
the delivery card 4, and the playback card 8 are similar 
5 to those shown in Fig. 40. 

[0863] However, in this movie distribution system ac- 
cording to the eleventh embodiment, the playback card 
8 also serves as a prepaid'card. 

[0864] That is, if the playback apparatus 3 makes pay- 
10 ment, the payment amount is recorded as the prepaid 
amount in the playback card 8. 

[0865] The relay server 2 checks the prepaid amount 
recorded in the playback card 8 received from the play- 
back apparatus 3, and the relay server 2 charges the 
15 fee according to the playback condition of the content 
data when the relay server 2 transmits the content data. 
More specifically, the relay server 2 reduces the prepaid 
amount recorded in the playback card 8 by a proper 
amount. 

[0866] If the remaining prepaid amount is not suffi- 
cient, the content data is not transmitted or the content 
data is transmitted after modifying the playback condi- 
tion in accordance with the remaining prepaid amount. 
For example, the number of times the content data is 
allowed to be played back may be employed as the play- 
back condition. 

[0867] In the following explanation of [B(11)] Config- 
uration of Server to [H(11)J Process Performed by Play- 
back Apparatus, it is assumed that when the playback 
apparatus 3 makes payment (into a bank account), the 
payment amount is recorded in the playback card 8, and 
the relay server 2 can charge a fee simply by changing 
the prepaid amount described in the playback card 8. 
However, the playback card 8 may also be used as a 
prepaid card in other various manners. 
[0868] For example, the playback apparatus 3 writes 
the prepaid amount into the playback card 8 without 
making actual payment. When the relay server 2 reduc- 
es the prepaid amount recorded in the playback card 3 
by a proper amount, the relay server 2 informs the bank 
center 550 of the amount of reduction. The bank center 
550 transfers the specified amount of money from the 
account of the playback apparatus 3 to the account of 
the relay server 2 (or the server 1 ). 
[0869] Alternatively, when the playback apparatus 3 
pays money into an account for prepayment, the prepaid 
amount is recorded in the playback card 8. When the 
relay server 2 updates the prepaid amount recorded in 
the playback card 8, the relay server 2 asks the bank 
center 550 to transfer a proper amount of money from 
the account for prepayment to the account of the relay 
server 2. 

[0870] In the present embodiment, when the relay 
sever 2 transmits content data, the relay server 2 re- 
ceives a proper amount of money depending upon the 
playback condition from the prepaid money. Alternative- 
ly, as in the tenth embodiment described above, the 
playback counter value indicating the number of times 
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the content data has been actually played back is written 
by the playback apparatus 3 into the playback card 8, 
and the relay server 2 reduces the prepaid amount by 
an amount corresponding to the playback counter value 
thereby receiving the corresponding amount of money. 5 
In this case, payment for the fee for the content data is 
made from the prepaid money after the end of the play- 
ing period. 

[B(1 1)] Configuration of Server 10 

[0871] The configuration of the server 1 is similar to 
that shown in Fig. 11 . 

[C(1 1 )] Configuration of Card 15 

[0872] Figs. 52A and 35B illustrate the configurations 
of the delivery card 4 and the playback card 8, respec- 
tively. The configurations are basically similar to those 
shown in Figs. 35A and 35B, respectively. However, the 20 
prepaid amount of money is added to the additional in- 
formation which is written in an encrypted form into the 
memory 83 of the playback card 8. The prepaid amount 
of money is written by the playback apparatus 3. The 
relay server 2 can reduce the prepaid amount of money. 25 
[0873] In the present embodiment, the reduction of 
the prepaid amount of money performed by the relay 
server 2 is based on the number of times the content 
data is allowed to be played back, which is predeter- 
mined as the playback condition. In other words, the 30 
number of times the playback apparatus 3 plays back 
the content data is limited to the predetermined number. 
[0874] For the above purpose, the number of times 
the content data is allowed to be played back is also 
recorded in the playback card 8. 35 
[0875] In the present embodiment, the number of 
times the content data is allowed to be played back is 
set by the relay server 2, and thus the number of times 
the content data is allowed to be played back is not de- 
scribed in the delivery card 4. Alternatively, the number 40 
of times the content data is allowed to be played back 
may be set by the server 1 . In this case, the number of 
times the content data is allowed to be played back is 
recorded in the delivery card 4 and delivered to the relay 
server 2. 45 

[D(11)] Configuration of Relay Server 

[0876] The relay server 2 has a similar configuration 
to that shown in Fig. 41 . However, the additional infor- so 
mation read from the playback card 8 sent from the mov- 
ie theater 502 includes the prepaid amount of money. 
The authentication/write controller 106 and the judg- 
ment unit 130 perform the charging process such that 
the prepaid amount is reduced by an amount corre- 55 
sponding to the number of times the content data has 
been played back. 

[0877] The additional information input via the input 



unit 117, the additional information written in the play- 
back card 8, the additional information stored in the stor- 
age unit 110, and the additional information which is 
stored together with the content data in the compressed 
data storage unit 109 and which is transmitted to the 
movie theater 502 all includes the number of times the 
content data is allowed to be played back, wherein the 
number of times the content data is allowed to be played 
back is the playback condition determined according to 
the prepaid amount of money. 

[E(1 1 )] Configuration of Playback Apparatus 

[0878] The construction of the playback apparatus 3 
is similar to that shown in Fig. 44 That is, the playback 
apparatus 3 includes a maximum playback number 
write/write controller 230. 

[0879] The number-of-times value indicating the 
number of times content data is allowed to be played 
back is included in additional information which is de- 
modulated and decrypted after being received by the re- 
ceiving unit 201, additional information which is read 
from the delivery card 4 and then decrypted, additional 
information stored in the storage unit 209, and additional 
information which is stored together with content data 
in the compressed data storage unit 109. 
[0880] The maximum playback number detection/ 
write controller 230 detects the number-of-times value 
indicating the number of times the content data is al- 
lowed to be played back, from the additional information 
corresponding to the content data to be played back. On 
the basis of the detected value, the maximum playback 
number detection/write controller 230 determines 
whether to permit the content data to be played back. 
[0881 ] Each time the content data is played back, the 
number of times the content data is allowed to be played 
back is decremented under the control of the maximum 
playback number detection/write controller 230. More 
specifically, each time the content data is played back, 
the value which indicates the number of times the con- 
tent data is allowed to be played back and which is in- 
cluded in the additional information stored in the storage 
unit 209 and also in the playback card 8 is decremented 
by one. 

[0882] In response to an operation of the user control 
unit 210, the charge controller 221 communicates with 
the bank center 550 to prepay a particular amount of 
money into a specified account. 

[0883] The delete/write/delete controller 206 is in- 
formed of the prepaid amount. In response, the authen- 
tication/write/delete controller 206 updates the prepaid 
amount of money stored in the playback card 8 or the 
storage unit 209 such that the prepaid amount is added 
to the current value described in the playback card 8. 

[F(1 1 )] Process Performed by Server 

[0884] The process performed by the server 1 is sim- 
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ilartothat shown in Fig. 13. However, information (such 
as a flag) of a large number of playback card 8 is record- 
ed in each delivery card 4 wherein flags are recorded in 
correspondence with playback IDs. Therefore, when a 
returned delivery card 4 is checked in steps F113 to 
F1 1 8, flags are examined to detect the status of the play- 
back apparatuses 3 corresponding to the respective 
playback card IDS. 

[G(11)] Process Performed by Relay Server 

[0885] Figs. 53A and 53B illustrate the process per- 
formed by the relay server 2. In Figs. 50A and 50B, sim- 
ilar steps to those shown in Fig. 14 or Fig. 42A or 42B 
are denoted by similar step numbers, and they are not 
described in further detail herein. 
[0886] More specifically, steps F121 to F509 shown 
in Fig. 53A are similar to those shown in Fig. 42A. 
[0887] In this eleventh embodiment, as in the seventh 
to tenth embodiments described above, transmission of 
the content data to the playback apparatus 3 is per- 
formed only if the deletion-from-playback-apparatus 
flag written in the playback card 8 indicates that the con- 
tent data which was used in the past has been deleted 
from the playback apparatus 3. After the content data is 
determined as having been deleted in step F509, the 
following steps are performed in the manner as de- 
scribed below. 

[0888] If a deletion-from-playback-apparatus flag is 
detected in step F509, the process proceeds to step 
F720 to check whether there is content data to be trans- 
mitted at the present time. That is, the schedule infor- 
mation is examined which is included in the additional 
information received from the server 1 or read from the 
delivery card 4. If it is determined that there is a content 
data to be transmitted at the present time, the process 
proceeds to step F720 to transmit the content data. 
However, no content data to be transmitted at the 
present time is detected, the process proceeds to step 
F142. 

[0889] In the case where content data to be transmit- 
ted at the present time is detected, the process pro- 
ceeds to step F721 to set the playback condition. 
[0890] In the present embodiment, the number of 
times the content data is allowed to be played back is 
set as the playback condition. More specifically, for ex- 
ample, according to the contract, the authentication/ 
write controller 1 06 sets the number of times the content 
data is allowed to be played back. 
[0891] Alternatively, the allowed playing period may 
be employed as the playback condition. Still alternative- 
ly, both the number of times the content data is allowed 
to be played back and the playing period may be set as 
the playback conditions. In the case where the playing 
period is set so as to be different from the playing period 
indicated by the schedule information included in the ad- 
ditional information, the schedule information is 
changed. 



[0892] Thereafter, in step F722, the prepaid amount 
is checked from the additional information read from the 
playback card 8 to determine whether the remaining 
amount is sufficient to charge the fee corresponding to 
5 the playback condition (the number of times the content 
data is allowed to be played back). 
[0893] If the remaining amount of money is insuffi- 
cient, the process proceeds to step F142 without trans- 
mitting the content data. 
10 [0894] If the remaining prepaid amount is sufficient, 
the process proceeds to step F723. In step F723, the 
database controller 113 retrieves, under the control of 
the distribution controller 112, the content data to be 
transmitted from the compressed data stored unit 109. 
15 [0895] In step F724, the encrypted content data and 
the associated additional information which have been 
retrieved are modulated by the modulator 114. 
[0896] In parallel, in step F725, information such as 
the additional information read from the delivery card 4 

20 is written into the playback card 8. More specifically, un- 
der the control of the authentication/write controller 1 06, 
the encryption unit 1 1 6 encrypts the decryption key DK1 
read from the delivery card 4 and transmits the encrypt- 
ed decryption key DK1 to the card read/write controller 

25 1 05. The additional information including the content ID, 
the destination identifiers ID1 and ID2, the schedule in- 
formation, and the number of times the content data is 
allowed to be played back, employed as the playback 
condition, are encrypted by the encryption unit 1 1 6 using 

30 the encryption key AK1 , and supplied to the card read/ 
write controller 105. 

[0897] Herein, the write/write controller 1 06 subtracts 
the amount of charge for the transmission of the content 
data, which was calculated in step F722, from the pre- 
ss paid amount recorded in the playback card 8. The re- 
sultant reduced value is written into the additional infor- 
mation. The additional information including the prepaid 
amount is encrypted by the encryption unit T16 using 
the encryption key AK1 and supplied to the card read/ 
*o write controller 105. 

[0898] The card read/write controller 1 05 writes them 
into the playback card 8. As a result, the prepaid amount 
described in the playback card 8 is updated into the re- 
duced value. 

45 [0899] In step F726, the encrypted content data and 
additional information, which have been modulated in 
step F724 by the modulator 114 after being read from 
the compressed data storage unit 1 09, are transmitted 
from the transmitting unit 115 to the playback apparatus 

50 3. Furthermore, the playback card 8 including the de- 
cryption key DK1 and the additional information written 
therein in step F725 is sent to the movie theater 502. 
[0900] In the process according to the present em- 
bodiment, transmission of the content data to the play- 

55 back apparatus 3 is performed only if the deletton-from- 
playback-apparatus flag written in the playback card 8 
indicates that the content data which was used in the 
past has been deleted from the playback apparatus 3 
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and if the charging for the fee of the content data can 
be successfully performed by reducing the prepaid 
amount described in the playback card 8. 
[0901] Although the process of writing data into the 
delivery card 4 to be returned to the server 1 is not 5 
shown in the flow charts shown in Figs. 53A and 53B as 
in Figs. 42A and 42B, the flags stored in the playback 
card 8 received from each movie theater 502 are written 
together with the playback card ID into the delivery card 
4 at a proper time after reading the data from the play- 10 
back card 8. This allows the server 1 to perform the 
checking process in steps F113 to F118 shown in Fig. 
13 when the server 1 receives the delivery card 4. 

[H(11)] Process Performed by Playback Apparatus 15 

[0902] Fig. 54 illustrates the process performed by the 
playback apparatus 3. In Fig. 54, similar steps to those 
shown in Fig. 47 or Fig. 9 are denoted by similar step 
numbers, and they are not described in further detail 20 
herein. 

[0903] In the process shown in Fig. 54, as in the proc- 
ess shown in Fig. 47, if a playback command is detected 
in step F56, steps F57 to F61 are performed to read in- 
formation such as the additional information from the 25 
playback card 8. Thereafter, in step F520, it is deter- 
mined whether to permit a playback operation. In this 
process in step F520, it is checked whether the addi- 
tional information read from the playback card 8 is iden- 
tical to the additional information which is retained in the 30 
storage unit 209 after being received via electronic 
transmission; whether the present time is within the al- 
lowed playing period indicated by the schedule informa- 
tion included in the additional information; and whether 
the playback card ID is identical to (or consistent with) 35 
the playback apparatus ID. Only when the above re- 
quirements are all satisfied, the process can proceed to 
step F64 to perform the playback operation. 
[0904] After retrieving the content data in step F64, 
the process proceeds to step F610 in which the maxi- 40 
mum playback number detection/write controller 230 
detects the number of times the content data is allowed 
to be played back, from the corresponding additional in- 
formation. If it is determined in the next step F611 that 
the number of times the content data is allowed to be 45 
played back is not equal to 0 t it is determined that the 
content data should be permitted to be played back. 
[0905] In this case, the process proceeds to step F61 2 
in which the number of times the content data is allowed 
to be played back, which is described in the additional so 
information, is decremented by 1 under the control of 
the maximum playback number write/write controller 
230. More specifically, in the additional information 
stored in the storage unit 209 and in the additional in- 
formation stored in the compressed data storage unit 55 
208, the number of times the content data is allowed to 
be played back is decremented, and the authentication/ 
write/delete controller 206 transmits the additional infor- 



mation including the decremented number of times the 
content data is allowed to be played back to the card 
read/write controller205 via the encryption unit 220. The 
card read/write controller 205 updates the additional in- 
formation recorded in the playback card 8 in accordance 
with the received additional information. 
[0906] In step F65, the content data is played back. 
[0907] Because each time the content data is played 
back, the number of times the content data is allowed 
to be played back is decremented, if a playback com- 
mand is issued after the content data has been played 
back as many times as the original number which was 
set by the relay server 2 in accordance with the prepaid 
amount, the number of times the content data is allowed 
to be played back is determined, in step F61 1 , as being 
equal to 0, and thus the process can no longer proceed 
to step F65 to further play back the content data. In this 
case, the process proceeds to step F613 to display a 
warning on the display unit 213. Then in step F68, the 
content data is deleted. 

[0908] That is, the playback apparatus 3 can play 
back the content data only as many times as allowed by 
the original value of the number of times the content data 
is allowed to be played back, which is set by the relay 
server 2 in accordance to the prepaid amount. 
[0909] In the case where the relay server 2 sets the 
playing period as the playback condition and payment 
is made by means of prepayment, the judgment of 
whether the present time is within the playing period is 
made in step F520. 

[0910] In the playback apparatus 3, the charging unit 
221 makes payment by means of prepayment at an ar- 
bitrary time in response to a command issued by a hu- 
man operator. 

[091 1 ] If a pay command issued by the operator is de- 
tected in step F72, the process proceeds to step F73. 
In step F73, the charging unit 221 communicates with 
the bank center 550 to ask the bank center 550 to make 
payment by an amount specified by the operator, into a 
specified bank account. 

[0912] If in step F701 a message indicating that the 
payment has been successfully made is received from 
the bank center 550, the additional information recorded 
in the playback card 8 is updated such that the amount 
of payment made this time is added to the current pre- 
paid amount. 

[0913] More specifically, the charging unit 221 informs 
the authentication/write/delete controller 206 of the 
amount of payment. The delete/write/delete controller 
206 updates the prepaid amount described in the play- 
back card 8 and also that stored in the storage unit 209 
such that the resultant prepaid amount becomes equal 
to the sum the current prepaid amount described in the 
playback card 8 and the amount of payment made this 
time. 
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[1(11)] Advantages 

[0914] As with the seventh, eighth, and ninth embod- 
iments described above, the eleventh embodiment pro- 
vides advantages (1) to (8) and advantages (20) and 
(21 ). In addition, the following advantages are obtained. 
[0915] (28) The relay server 2 (or the server 1 ) prop- 
erly sets the playback condition of the content data. For 
example ; the number of times the content data is al- 
lowed to be played back by the playback apparatus 3 is 
set. After charging the fee corresponding to the play- 
' back condition on the prepayment basis, the content da- 
ta is transmitted. This makes it possible for the relay 
server 2 to easily charge the fee in a highly reliable fash- 
ion. 

[0916] (29) In the case the prepaid amount is insuffi- 
cient, the relay server 2 may not transmit the content 
data or may transmit the content data after reducing the 
number of limes the content data is allowed to be played 
back to a value corresponding to the remaining prepaid 
amount . That is, transmission of the content may be per- 
formed in a flexible manner depending upon the situa- 
tion 

[0917] (30) The playback apparatus 3 can make pay- 
ment for the fee of the transmission of the content data 
simply by make prepayment at an arbitrary time. 

Specific Examples of Implementations of Embodiments 

[0918] Embodiments of the invention have been de- 
scribed above. Specific examples of implementations of 
the embodiments are described below. 
[0919] The processes performed by the server 1 , the 
relay server 2. and the playback apparatus 3, respec- 
tively may be performed by means of hardware or soft- 
ware In the case where the processes are performed 
by means of software, a software program is installed 
on a computer embedded in special-purpose hardware 
such as a transmitter/receiver apparatus or a recording/ 
playing back apparatus or is installed on a general-pur- 
pose computer. 

[0920] Fig. 55 illustrates an example of a configura- 
tion ol a computer in which a program used to execute 
the processes described above is installed. 
[0921] The program may be stored, in advance, on a 
hard disk 405 serving as a storage medium or in a ROM 
403 which are disposed inside the computer. 
[0922] Alternatively, the program may be stored (re- 
corded) temporarily or permanently on a removable 
storage medium 111 such as a floppy disk, a CD-ROM 
(Compact Disc Read Only Memory), a MO (Magnetoop- 
tical) disk, a DVD (Digital Versatile Disc), a magnetic 
disk, or a semiconductor memory. Such a removable re- 
cording medium 411 may be provided in the form of so- 
called package software. 

[0923] Instead of installing the program from the re- 
movable recording medium 411 onto the computer, the 
program may also be transferred to the computer from 



a download site via a digital broadcasting satellite by 
means of radio transmission or via a network such as a 
LAN (Local Area Network) or the Internet by means of 
wire communication. In this case, the computer re- 
5 ceives, using a communication unit 408, the program 
transmitted in such a manner and installed the program 
on the hard disk 405 disposed in the computer. 
[0924] The computer includes a CPU (Central 
Processing Unit) 402. When a user inputs a command 

10 by operating an input device 407 such as a keyboard or 
a mouse, the command is transferred to the CPU 402 
via the input/output interface 410. In accordance with 
the command, the CPU 402 executes a program stored 
in the ROM (Read Only Memory) 403. Alternatively, the 

15 CPU 402 may execute a program loaded in a RAM 
(Random Access Memory) 404 wherein the program 
may be loaded into the RAM 404 by transferring a pro- 
gram stored on the hard disk 405 into the RAM 404, or 
transferring a program which has been installed on the 

20 hard disk 405 after being received from a satellite or a 
. network via the communication unit 408, or transferring 
a program which has been installed on the hard disk 405 
after being read from a removable recording medium 
411 loaded on a drive 409, By executing the program, 

25 the CPU 402 performs the process described above 
with reference to the flow charts. 

[0925] The CPU 402 outputs the result of the process, 
as required, to an output device such as a LCD (Liquid 
Crystal Display) or a loudspeaker via an input/output in- 
30 terface 41 0. The result of the process may also be trans- 
mitted via the communication unit 408 or may be stored 
on the hard disk 405. 

[0926] In the present invention, the processing steps 
described in the program to be executed by a computer 

35 to perform various kinds of processing are not neces- 
sarily required to be executed in time sequence accord- 
ing to the order described in the flow chart. Instead, the 
processing steps may be performed in parallel or sepa- 
rately (by means of parallel processing or object 

40 processing). 

[0927] The program may be executed either by a sin- 
gle computer or by a plurality of computers in a distrib- 
uted fashion. The program may be transferred to a com- 
puter at a remote site and may be executed thereby. 

45 [0928] The first to eleventh embodiments have been 
described above byway of example only, but not limita- 
tion. Various modifications and changes in terms of the 
configuration and the process are possible. Further- 
more, two or more embodiments regarding the configu- 

50 ration or process may be combined. Also in such a case, 
the configurations and the processes of the server 1 , the 
relay server 2, and the playback apparatus 3 may be 
implemented using a computer such as that shown in 
Fig. 55. 

55 [0929] As can be understood from the above descrip- 
tion, embodiments of the present invention have various 
great advantages. 

[0930] That is, content data including a video source 
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such as a movie data and/or an audio source is trans- 
mitted from a server apparatus to a playback apparatus 
after being encrypted. A key used to decrypt the encrypt- 
ed data is stored on a storage medium such as a mem- 
ory card and the storage medium is sent from the server 
apparatus to the playback apparatus in parallel with the 
transmission of the content data. This allows both the 
content data and the key to be delivered without being 
hacked during the delivery, and thus high security is 
achieved in the delivery. 

[0931] When playing-back of the content data per- 
formed by the playback apparatus in for example a mov- 
ie theater is completed, the storage medium is returned 
to the server apparatus. The server apparatus checks 
whether an authorized use of the content data delivered 
by means of electronic transmission is made, on the ba- 
sis of information recorded on the storage medium. This 
makes it possible for the server to properly manage and 
control the use of the data at the playback apparatus 
site. This makes it possible to monitor whether the data 
is copied or transferred in an unauthorized manner. 
[0932] Thus, it is ensured that data such as a movie 
data whose copyright is needed to be protected can be 
transmitted in a highly secure manner. In particular, em- 
bodiments of the present invention are useful when ap- 
plied to a movie distribution system, because a movie 
can be distributed at less cost and with higher efficiency 
than can be achieved by a conventional movie distribu- 
tion system using a film. 

[0933] Information for the purpose of management 
performed at the server site and information for the pur- 
pose of controlling the playback operation at the play- 
back apparatus site may be stored on the storage me- 
dium. Specific examples of such information include a 
playing period during which the data is allowed to be 
played back, settlement information, the number of 
times the data is allowed to be played back, a delete flag 
indicating that the data has been deleted, information 
(ID of transfer means) indicating that the data has been 
output or transferred, and payment amount information. 
[0934] In so far as the embodiments of the invention 
described above are implemented, at least in part, using 
software-controlled data processing apparatus, it will be 
appreciated that a computer program providing such 
software control and a transmission, storage or other 
medium by which such a computer program is provided 
are envisaged as aspects of the present invention. 



Claims 

1. A data delivery system comprising: 

encrypting means for encrypting data and out- 
putting the resultant encrypted data; 
transmitting means fortransmitting the encrypt- 
ed data; 

recording means for recording, on a storage 



medium, a key used to decrypt the encrypted 
data; 

receiving means for receiving the encrypted da- 
ta transmitted by the transmitting means; 
5 reading means for reading the key stored on the 

storage medium; 

decrypting means for decrypting the encrypted 
data received by the receiving means, using the 
key read by the reading means; 

10 reproducing means for reproducing the data 

decrypted by the decrypting means; 
control means for controlling the reproduction 
• of the data performed by the reproducing 
means in accordance with information stored 

15 on the storage medium; and 

judgment means for detecting unauthorized 
use of the data, on the basis of information 
stored on the storage medium. 

20 2. A data delivery system according to Claim 1 , where- 
in 

the recording means records an allowed repro- 
duction period during which data correspond- 

25 ing to the key stored on the storage medium is 

allowed to be reproduced; and 
the judgment means detects unauthorized use 
of the data, on the basis of the allowed repro- 
duction period recorded on the storage medi- 

30 urn. 

3. A data delivery system according to Claim 1 , further 
comprising: 

55 settling means for performing settlement corre- 

sponding to data reproduced by the reproduc- 
ing means, and 

settlement information recording means for re- 
cording settlement information on the storage 
40 medium in response to the settlement, 

wherein the judgment means detects unau- 
thorized use of the data, on the basis of the settle- 
ment information stored on the storage medium. 

45 

4. A data delivery system according to Claim 1 , further 
comprising: 

storage means for storing the received encrypt- 
50 ed data; and 

delete flag recording means for, when the en- 
crypted data stored in the storage means is de- 
leted, recording a delete flag on the storage me- 
dium, 

55 

wherein the judgment means detects unau- 
thorized use of the data by judging whether the de- 
lete flag is recorded on the storage medium. 
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5. A data delivery system according to Claim 1 , where- 
in 

the recording means records an allowed repro- 
duction period during which data correspond- 5 
ing to the key stored on the storage medium is 
allowed to be reproduced; and 
the control means enables or disables the re- 
producing means to reproduce the data, in ac- 
cordance with the allowed reproduction period 10 
recorded on the storage means. 

6. A data delivery system according to Claim 1 , where- 
in 

15 

the recording means records a number-of- 
times value indicating the number of times data 
corresponding to the key stored on the storage 
medium is allowed to be reproduced; and 
the control means enables or disables the re- 20 
producing means to reproduce the data in ac- 
cordance with the number-of-times value re- 
corded on the storage medium. 

7. A data delivery system according to Claim 6, further 25 
comprising embedding means for embedding an 
electronic watermark indicating the allowance of re- 
production into the data, wherein the control means 
reduces the number-of-times value each time the 
reproducing means reproduces the data, and the 30 
control means rewrites the electronic watermark 
embedded in the data so as to indicate inhibition of 
reproduction when the number-of-times value be- 
comes equal to zero. 

35. 

8. A data delivery system according to Claim 1 , further 
comprising: 

transfer means capable of transferring the en- 
crypted data received by the receiving means 40 
to another electronic apparatus; 
detecting means for detecting a transfer oper- 
ation performed by the transfer means; and 
ID recording means for, when the detecting 
means detects a transfer operation, recording 45 
an ID corresponding to the transfer means on 
the storage medium. 

9. A data delivery system according to Claim 1 , further 
comprising: so 

a mounting part for mounting the storage me- 
dium therein: 

memory means on which information re- 55 
corded on the storage medium is stored 
when the storage medium is mounted in 
the mounting part; and 



rewriting means for rewriting the informa- 
tion recorded on the storage medium, 

wherein the control means controls the repro- 
duction of the data performed by the reproducing 
means in accordance with the information stored in 
the memory means. 

10. A data delivery system according to Claim 2 or 5, 
further comprising rewriting means capable of re- 
writing the allowed reproduction period during 
which the data corresponding to the key stored on 
the storage medium is allowed to be reproduced, 
so as to extend the allowed reproduction period. 

11. A data delivery system according to Claim 1 , further 
comprising updating means for updating the infor- 
mation recorded on the storage medium if the judg- 
ment means determines, from the information re- 
corded on the storage medium, that the use of the 
data is valid. 

12. A data delivery system according to Claim 11, 
wherein 

the recording means records, on the storage 
medium, an identifier of the data, an allowed 
reproduction period assigned to the data, and 
a key used to decrypt the data; and 
the updating means updates the information re- 
corded on the storage medium, if the judgment 
means determines, from the information re- 
corded on the storage medium, that the use of 
the data is valid. 

1 3. A data delivery system according to Claim 6, further 
comprising settling means for performing settle- 
ment in accordance with the number-of-times value 
recorded on the storage medium by the recording 
means, the number-of-times value indicating the 
number of times the data is allowed to be repro- 
duced. 

14. A data delivery system according to Claim 1, further 
comprising: 

counter means for counting the number of 
times the data is reproduced by the reproducing 
means; and 

settlement means for performing settlement in 
accordance with a count value output by the 
counter means. 

1 5. A data delivery system according to Claim 1 , further 
comprising: 

payment amount recording means for record- 
ing payment amount information on the storage 
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medium in response to paying a fee; and 
payment amount updating means for updating 
the payment amount information recorded on 
the storage medium in such a manner as to re- 
duce the payment amount in accordance with 
the information recorded on the storage medi- 
um by the recording means. 

16. A server apparatus for delivering data to a repro- 
ducing apparatus, comprising: 

encrypting means for encrypting data and out- 
putting the resultant encrypted data; 
transmitting means fortransmittingthe encrypt- 
ed data to the reproducing apparatus; 
recording means for recording, on a storage 
medium, a key used to decrypt the encrypted 
data; and 

judgmenL means for detecting unauthorized 
use of the data transmitted from the transmit- 
ting means, on the basis of information stored 
on th e storage medium retu rned from the repro- 
duction apparatus. 



17. A server apparatus according to Claim 1 6, wherein 
tne recording means records an altowed reproduc- 
tion period during which data corresponding to the 
key stored on the storage medium is allowed to be 
reproduced. 

18. A server apparatus according to Claim 1 7, wherein 
tne judgment means detects unauthorized use of 
tne data, on the basis of the allowed reproduction 
period recorded on the storage medium. 

19. A server apparatus according to Claim 1 6, wherein 
me judgment means detects unauthorized use of 
tne data, on the basis of the settlement information 
recorded on the storage medium by the reproducing 
apparatus. 



20 



A server apparatus according to Claim 1 6, wherein 
tne judgment means detects unauthorized use of 
tne data by judging whether a delete flag, which in- 
oicates that the data transmitted from the transmit- 
ting means has been deleted, is recorded on a stor- 
age medium returned from the reproducing appa- 
ratus. 

A server apparatus according to Claim 16, wherein 
the recording means records a number-of-times 
value indicating the number of times data corre- 
sponding to the key stored on the storage medium 
is allowed to be reproduced. 



22. A server apparatus according to Claim 16, further 
comprising embedding means for embedding an 
electronic watermark indicating the allowance of re- 
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production into the data. 

A server apparatus according to Claim 16, wherein 
the judgment means detects unauthorized use of 
the data by judging whether information indicating 
that the data transmitted from the transmitting 
means has been transferred is recorded on a stor- 
age medium returned from the reproducing appa- 
ratus. 

A server apparatus according to Claim 17, further 
comprising rewriting means capable of rewriting the 
allowed reproduction period during which the data 
corresponding to the key stored on the storage me- 
dium is allowed to be reproduced, so as to extend 
the allowed reproduction period. 



25. A server apparatus according to Claim 16, further 
comprising updating means for updating the infor- 
mation recorded on the storage medium if the judg- 
ment means determines, from the information re- 
corded on the storage medium, that the use of the 
data is valid. 

26. A server apparatus according to Claim 25, wherein 

the recording means records, on the storage 
medium, an identifier of the data, an allowed 
reproduction period assigned to the data, and 
a key used to decrypt the data; and 
the updating means updates the information re- 
corded on the storage medium, if the judgment 
means determines, from the information re- 
corded on the storage medium, that the use of 
the data is valid. 



27. 



28. 
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A server apparatus according to Claim 16, further 
comprising, payment amount updating means for, 
when payment amount information is recorded on 
the storage medium in response to payment of a 
fee performed by the reproducing apparatus, updat- 
ing the payment amount information recorded on 
the storage medium in such a manner as to reduce 
the payment amount in accordance with the infor- 
mation recorded on the storage medium by the re- 
cording means. 

A reproducing apparatus to which encrypted data 
is transmitted from a predetermined server appara- 
tus and to which a storage medium including a key 
stored thereon for use in decrypting the encrypted 
data is sent, the reproducing apparatus comprising: 

receiving means for receiving the encrypted da- 
ta transmitted from the predetermined server 
apparatus; 

reading means for reading the key stored on the 
storage medium; 
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decrypting means for decrypting the encrypted 
data received by the receiving means, using the 
key read by the reading means; 
reproducing means for reproducing the data 
decrypted by the decrypting means; and 
control means for controlling the reproduction 
of the data performed by the reproducing 
means in accordance with information stored 
on the storage medium. 

29. A reproducing apparatus according to Claim 28, 
wherein 

the recording means records an allowed repro- 
duction period during which data correspond- 
ing to the key stored on the storage medium is 
allowed to be reproduced; and 
the control means enables or disables the re- 
producing means to reproduce the data, in ac- 
cordance with the allowed reproduction period 
recorded on the storage means. 

30. A reproducing apparatus according to Claim 28, fur- 
ther comprising: 

settling means for performing settlement corre- 
sponding to data reproduced by the reproduc- 
ing means; and 

settlement information recording means for re- 
cording settlement information on the storage 
medium in response to the settlement. 

31. A reproducing apparatus according to Claim 28, fur- 
ther comprising: 

storage means for storing the received encrypt- 
ed data: and 

delete flag recording means for, when the en- 
crypted data stored in the storage means is de- 
leted, recording a delete flag on the storage me- 
dium. 

32. A reproducing apparatus according to Claim 28, 
wherein 

a number-of-times value, indicating the number 
of times data corresponding to the key stored 
on the storage medium is allowed to be repro- 
duced, is stored on the storage medium; and 
the control means enables or disables the re- 
producing means to reproduce the data in ac- 
cordance with the number-of-times value re- 
corded on the storage medium. 

33. A reproducing apparatus according to Claim 32, 
wherein 

data received by the receiving means includes 



transfer means capable of transferring the en- 
crypted data received by the receiving means 
to another electronic apparatus; 
detecting means for detecting a transfer oper- 
ation performed by the transfer means; and 
ID recording means for, when the detecting 
means detects a transfer operation, recording 
an ID corresponding to the transfer means on 
the storage medium. 

25 35. A reproducing apparatus according to Claim 28, fur- 
ther comprising: 

a mounting part for mounting the storage me- 
dium therein; 

30 memory means on which information recorded 

on the storage medium is stored when the stor- 
age medium is mounted in the mounting part; 
and 

rewriting means for rewriting the information re- 
35 corded on the storage medium, 

wherein the control means controls the repro- 
duction of the data performed by the reproducing 
means in accordance with the information stored in 
40 the memory means. 

36. A reproducing apparatus according to Claim 29, fur- 
ther comprising rewriting means capable of rewrit- 
ing the allowed reproduction period during which 

45 the data corresponding to the key stored on the stor- 
age medium is allowed to be reproduced, so as to 
extend the allowed reproduction period. 

37. A reproducing apparatus according to Claim 32, fur- 
50 ther comprising settling means for performing set- 
tlement in accordance with the number-of-times 
value recorded on the storage medium, the 
number-of-times value indicating the number of 
times the data is allowed to be reproduced. 

55 

38. A reproducing apparatus according to Claim 28, fur- 
ther comprising: 



an electronic watermark embedded in the data, 
the watermark indicating that the data is per- 
mitted to be reproduced; and 
the control means reduces the number-of- 
times value each time the reproducing means 
reproduces the data, and the control means re- 
writes the electronic watermark embedded in 
the data so as to indicate inhibition of reproduc- 
tion when the number-of-times value becomes 
*b equal to zero. 

34. A reproducing apparatus according to Claim 28, fur- 
ther comprising: 

15 
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counter means for counting the number of 
times the data is reproduced by the reproducing 
means; and 

settlement means for performing settlement in 
accordance with a count value output by the 
counter means. 

39. A reproducing apparatus according to Claim 28, fur- 
ther comprising payment amount recording means 
for recording payment amount information on the 
storage medium in response to paying a fee. 

40. A data delivery method comprising: 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
a transmitting step for transmitting the encrypt- 
ed data; 

a recording step for recording, on a storage me- 
dium, a key used to decrypt the encrypted data; 
a receiving step for receiving the encrypted da- 
ta transmitted in the transmitting step; 
a reading step for reading the key stored on the 
storage medium; 

a decrypting step for decrypting the encrypted 
data received in the receiving step, using the 
key read in the reading step; 
a reproducing step for reproducing the data de- 
crypted in the decrypting step; 
a control step for controlling the reproduction of 
the data performed in the reproducing step, in 
accordance with information stored on the stor- 
age medium; and 

a judgment step for detecting unauthorized use 
of the data, on the basis of information stored 
on the storage medium. 

41. A data delivery method according to Claim 40, 
wherein 

the recording step records an allowed repro- 
duction period during which data correspond- 
ing to the key stored on the storage medium is 
allowed to be reproduced; and 
the judgment step detects unauthorized use of 
the data, on the basis of the allowed reproduc- 
tion period recorded on the storage medium. 

42. A data delivery method according to Claim 40, fur- 
ther comprising: 

a settling step for performing settlement corre- 
sponding to data reproduced in the reproducing 
step; and 

a settlement information recording step for re- 
cording settlement information on the storage 
medium in response to the settlement, 



wherein the judgment step detects unauthor- 
ized use of the data, on the basis of the settlement 
information stored on the storage medium. 

5 43. A data delivery method according to Claim 40, fur- 
ther comprising: 

a storing step for storing the received encrypted 
data in storage means; and 
10 a delete flag recording step for, when the en- 

crypted data stored in the storage means is de- 
leted, recording a delete flag on the storage me- 
dium, 

15 wherein the judgment step detects unauthor- 

ized use of the data by judging whether the delete 
flag is recorded on the storage medium. 

44. A data delivery method according to Claim 40, 
20 wherein 

the recording step records an allowed repro- 
duction period during which data correspond- 
ing to the key stored on the storage medium is 
25 allowed to be reproduced; and 

the control step enables or disables the repro- 
duction of the data in the reproducing step, in 
accordance with the allowed reproduction peri- 
od recorded on the storage medium. 

30 

45. A data delivery method according to Claim 40, 
wherein 

the recording step records a number-of-times 
35 value indicating the number of times data cor- 

responding to the key stored on the storage me- 
dium is allowed to be reproduced; and 
the control means enables or disables the re- 
production of the data in the reproducing step 
40 in accordance with the number-of-times value 

recorded on the storage medium. 

46. A data delivery method according to Claim 45, fur- 
ther comprising an embedding step for embedding 

45 an electronic watermark indicating the allowance of 
reproduction into the data, wherein the control step 
reduces the number-of-times value each time the 
reproducing step reproduces the data, and the con- 
trol step rewrites the electronic watermark embed- 
50 ded in the data so as to indicate inhibition of repro- 
duction when the number-of-times value becomes 
equal to zero. 

47. A data delivery method according to Claim 40, fur- 
55 ther comprising: 

a transfer step in which the encrypted data re- 
ceived in the receiving step may be transferred 
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by transfer means to another electronic appa- 
ratus; 

a detecting step for detecting transferring, in 
the transfer step, of the encrypted data re- 
ceived in the receiving step to another electron- 
ic apparatus; and 

an ID recording step for, when the detecting 
step detects transferring of the encrypted data, 
recording an ID corresponding to the transfer 
means on the storage medium. 

48. A data delivery method according to Claim 40, fur- 
ther comprising: 

a mounting step for mounting the storage me- 
dium into a mounting part; 
a memorizing step for storing, into memory 
means, information recorded on the storage 
medium when the storage medium is mounted 
in the mounting part: and 
a rewriting step for rewriting the information re- 
corded on the storage medium, 

wherein the control step controls the repro- 
duction of the data performed in the reproducing 
step in accordance with the information stored in the 
memory means. 

49. A data delivery method according to Claim 41 or 44, 
further comprising a rewriting step in which the al- 
lowed reproduction period, during which the data 
corresponding to the key stored on the storage me- 
dium is allowed to be reproduced, may be rewritten 
so as to extend the allowed reproduction period. 

50. A data delivery method according to Claim 40, fur- 
ther comprising an updating step for updating the 
information recorded on the storage medium if the 
judgment step determines, from the information re- 
corded on the storage medium, that the use of the 
data is valid. 

51. A data delivery method according to Claim 50, 
wherein 

the recording step records, on the storage me- 
dium, an identifier of the data, an allowed re- 
production period assigned to the data, and -a 
key used to decrypt the data; and 
the updating step updates the information re- 
corded on the storage medium, if the judgment 
step determines, from the information recorded 
on the storage medium, that the use of the data 
is valid. 

52. A data delivery method according to Claim 45, fur- 
ther comprising a settling step for performing set- 
tlement in accordance with the number-of-times 



value recorded on the storage medium in the re- 
cording step, the number-of-times value indicating 
the number of times the data is allowed to be repro- 
duced. 

5 

53. A data delivery method according to Claim 40, fur- 
ther comprising: 

a counting step for counting the number of 
10 . times the data is reproduced in the reproducing 

step; and 

a settlement step for performing settlement in 
accordance with a count value counted in the 
counting step. 

15 

54. A data delivery method according to Claim 40, fur- 
ther comprising: 

a payment amount recording step for recording 
20 payment amount information on the storage 

medium in response to paying a fee; and 
a payment amount updating step for updating 
the payment amount information recorded on 
the storage medium in such a manner as to re- 
25 duce the payment amount in accordance with 

the information recorded on the storage medi- 
um in the recording step. 

55. A method of controlling a server apparatus so as to 
30 deliver data from the server apparatus to a repro- 
ducing apparatus, comprising: 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
35 a transmitting step for transmitting the encrypt- 

ed data to the reproducing apparatus; 
a recording step for recording, on a storage me- 
dium, a key used to decrypt the encrypted data; 
and 

40 a judgment step for detecting unauthorized use 

of the data transmitted in the transmitting step, 
on the basis of information stored on the stor- 
age medium returned from the reproduction ap- 
paratus. 

45 

56. A method of controlling a server apparatus, accord- 
ing to Claim 55, wherein the recording step records 
an allowed reproduction period during which data 
corresponding to the key stored on the storage me- 

so dium is allowed to be reproduced. 

57. A method of controlling a server apparatus, accord- 
ing to Claim 56, wherein the judgment step detects 
unauthorized use of the data, on the basis of the 

55 allowed reproduction period recorded on the stor- 

age medium. 

58. A method of controlling a server apparatus, accord- 
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ing to Claim 55, wherein the judgment step detects 
unauthorized use of the data, on the basis of the 
settlement information recorded on the storage me- 
dium by the reproducing apparatus. 

59. A method of controlling a server apparatus, accord- 
ing to Claim 55, wherein the judgment step detects 
unauthorized use of the data by judging whether a 
delete flag, which indicates that the data transmitted 
in the transmitting step has been deleted, is record- 
ed on a storage medium returned from the repro- 
ducing apparatus. 

60. A method of controlling a server apparatus, accord- 
ing to Claim 55, wherein the recording step records 
a number-of -times value indicating the number of 
times data corresponding to the key stored on the 
storage medium is allowed to be reproduced. 

61. A method of controlling a server apparatus, accord- 
ing to Claim 55, further comprising an embedding 
step for embedding an electronic watermark indi- 
cating the allowance of reproduction into the data. 



is valid. 



66. 



62. 



63 



A method of controlling a server apparatus, accord- 
ing to Claim 55, wherein the judgment step detects 
unauthorized use of the data by judging whether in- 
formation indicating that the data transmitted in the 
transmitting step has been transferred is recorded 
on a storage medium returned from the reproducing 
apparatus. 

A method of controlling a server apparatus, accord- 
ing to Claim 56, further comprising a rewriting step 
in which the allowed reproduction period, during 
which the data corresponding to the key stored on 
the storage medium is allowed to be reproduced, 
may be rewritten so as to extend the allowed repro- 
duction period. 



64. A method of controlling a server apparatus, accord- 
ing to Claim 55, further comprising an updating step 
for updating the information recorded on the stor- 
age medium if the judgment step determines, from 
the information recorded on the storage medium, 
that the use of the data is valid. 

65. A method of controlling a server apparatus, accord- 
ing to Claim 64, wherein 

the recording step records, on the storage me- 
dium, an identifier of the data, an allowed re- 
production period assigned to the data, and a 
key used to decrypt the data; and 
the updating step updates the information re- 
corded on the storage medium, if the judgment 
step determines, from the information recorded 
on the storage medium, that the use of the data 
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A method of controlling a server apparatus, accord- 
ing to Claim 55, further comprising a payment 
amount updating step for, when payment amount 
information is recorded on the storage medium in 
response to payment of a fee performed by the re- 
producing apparatus, updating the payment 
amount information recorded on the storage medi- 
um in such a manner as to reduce the payment 
amount in accordance with the information record- 
ed on the storage medium in the recording step. 

67. A method of controlling a reproducing apparatus to 
which encrypted data is transmitted from a prede- 
termined server apparatus and to which a storage 
medium including a key stored thereon for use in 
decrypting the encrypted data is sent, the method 
comprising: 

a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 
apparatus; 

a reading step for reading the key stored on the 
storage medium; 

a decrypting step for decrypting the encrypted 
data received in the receiving step, using the 
key read in the reading step; 
a reproducing step for reproducing the data de- 
crypted in the decrypting step; and 
a control step for controlling the reproduction of 
the data performed in the reproducing step in 
accordance with information stored on the stor- 
age medium. 

68. A method of controlling a reproducing apparatus, 
according to Claim 67, wherein 

the recording step records an allowed repro- 
duction period during which data correspond- 
ing to the key stored on the storage medium is 
allowed to be reproduced; and 
the control step enables or disables the repro- 
duction of the data in the reproducing step, in 
accordance with the allowed reproduction peri- 
od recorded on the storage means. 

69. A method of controlling a reproducing apparatus, 
according to Claim 67, further comprising: 

a settling step for performing settlement corre- 
sponding to data reproduced in the reproducing 
step; and 

a settlement information recording step for re- 
cording settlement information on the storage 
medium in response to the settlement. 

70. A method of controlling a reproducing apparatus, 
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according to Claim 67 : further comprising: 

a storing step for storing the received encrypted 
data into storage means; and 
a delete flag recording step for, when the en- 5 
crypted data stored in the storage means is de- 
leted, recording a delete flag on the storage me- 
dium. 

71. A method of controlling a reproducing apparatus, to 
according to Claim 67 : wherein 

a number-of -times value, indicating the number 
of times data corresponding to the key stored 
on the storage medium is allowed to be repro- 15 
duced, is stored on the storage medium; and 
the control step enables or disables the repro- 
duction of the data in the reproducing step, in 
accordance with the number-of-times value re- 
corded on the storage medium. 20 

72. A method of controlling a reproducing apparatus, 
according to Claim 71 : wherein 

data received in the receiving step includes an 25 
electronic watermark embedded in the data, 
the watermark indicating that the data is per- 
mitted to be reproduced; and 
the control step reduces the number-of-times 
value each time the reproducing step reproduc- 30 
es the data, and the control step rewrites the 
electronic watermark embedded in the data so 
as to indicate inhibition of reproduction when 
the number-of-times value becomes equal to 
zero. 35 

73. A method of controlling a reproducing apparatus, 
according to Claim 67 : further comprising: 

a transfer step in which the encrypted data re- 40 
ceived in the receiving step may be transferred 
by transfer means to another electronic appa- 
ratus; 

a detecting step for detecting transferring, in 
the transfer step, of the encrypted data re- 45 
ceived in the receiving step to another electron- 
ic apparatus; and 

an ID recording step for, when the detecting 
step detects transferring of the encrypted data, 
recording an ID corresponding to the transfer so 
means on the storage medium. 

74. A method of controlling a reproducing apparatus, 
according to Claim 67, further comprising: 

55 

a mounting step for mounting the storage me- 
dium into a mounting part; 
a memorizing step for storing, into memory 



means, information recorded on the storage 
medium when the storage medium is mounted 
in the mounting part; and 
a rewriting step for rewriting the information re- 
corded on the storage medium, 

wherein the control step controls the repro- 
duction of the data performed in the reproducing 
step in accordance with the inf ormation stored in the 
memory means. 

75. A method of controlling a reproducing apparatus, 
according to Claim 68, further comprising a rewrit- 
ing step in which the allowed reproduction period, 
during which the data corresponding to the key 
stored on the storage medium is allowed to be re- 
produced, may be rewritten so as to extend the al- 
lowed reproduction period. 

76. A method of controlling a reproducing apparatus, 
according to Claim 71 , further comprising a settling 
step for performing settlement in accordance with 
the number-of-times value recorded on the storage 
medium, the number-of-times value indicating the 
number of times the data is allowed to be repro- 
duced. 

77. A method of controlling a reproducing apparatus, 
according to Claim 67, further comprising: 

a counting step for counting the number of 
times the data is reproduced in the reproducing 
step; and 

a settlement step for performing settlement in 
accordance with a count value counted in the 
counting step. 

78. A method of controlling a reproducing apparatus, 
according to Claim 67, further comprising a pay- 
ment amount recording step for recording payment 
amount information on the storage medium in re- 
sponse to paying a fee. 

79. A program storage medium including a processing 
program, stored thereon , for controlling a server ap- 
paratus to perform a process of delivering dataf rom 
the server apparatus to a reproducing apparatus, 
the process comprising: 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
a transmitting step for transmitting the encrypt- 
ed data to the reproducing apparatus; 
a recording step for recording, on an informa- 
tion storage medium, a key used to decrypt the 
encrypted data; and 

a judgment step for detecting unauthorized use 
of the data transmitted in the transmitting step, 
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on the basis of information stored on the infor- 
mation storage medium returned from the re- 
production apparatus. 

A program storage medium according to Claim 79, 
wherein the recording step records an allowed re- 
production period during which data corresponding 
to the key stored on the information storage medium 
is allowed to be reproduced. 



81. A program storage medium according to Claim 80, 
wherein the judgment step detects unauthorized 
use of the data, on the basis of the allowed repro- 
duction period recorded on the information storage 
medium. 



83 



84 



A program storage medium according to Claim 79, 
wherein the judgment step detects unauthorized 
use of the data by judging whether a delete flag, 
which indicates that the data transmitted in the 
transmitting step has been deleted, is recorded on 
an information storage medium returned from the 
reproducing apparatus. 

A program storage medium according to Claim 79, 
wherein the recording step records a number-of- 
times value indicating the number of times data cor- 
responding to the key stored on the information 
storage medium is allowed to be reproduced. 



86. 



87 



A program storage medium according to Claim 79, 
wherein the judgment step detects unauthorized 
use of the data by judging whether information in- 
dicating that the data transmitted in the transmitting 
step has been transferred is recorded on an infor- 
mation storage medium returned from the reproduc- 
ing apparatus. 

A program storage medium according to Claim 80, 
wherein the process further comprises a rewriting 
step in which the allowed reproduction period, dur- 
ing which the data corresponding to the key stored 
on the storage medium is allowed to be reproduced, 
may be rewritten so as to extend the allowed repro- 
duction period. 



10 



15 



82. A program storage medium according to Claim 79, 
wherein the judgment step detects unauthorized 
use of the data, on the basis of the settlement infor- 
mation recorded on the information storage medium 20 
by the reproducing apparatus. 



25 



30 



35 



85. A program storage medium according to Claim 79, 
wherein the process further comprises an embed- 
ding step for embedding an electronic watermark 
indicating the allowance of reproduction into the da- 40 
ta. 



45 



50 



55 



88. A program storage medium according to Claim 79, 
wherein the process further comprises an updating 
step for updating the information recorded on the 
storage medium if the judgment step determines, 
from the information recorded on the storage medi- 
um, that the use of the data is valid. 

89. A program storage medium according to Claim 88, 
wherein 

the recording step records, on the information 
storage medium, an identifier of the data, an al- 
lowed reproduction period assigned to the data, 
and a key used to decrypt the data; and 
the updating step updates the information re- 
corded on the information storage medium, if 
the judgment step determines, from the infor- 
mation recorded on the information storage 
medium, that the use of the data is valid. 

90. A program storage medium according to Claim 79, 
wherein the process further comprises a payment 
amount updating step for, when payment amount 
information is recorded on the information storage 
medium in response to payment of a fee performed 
by the reproducing apparatus, updating the pay- 
ment amount information recorded on the informa- 
tion storage medium in such a manner as to reduce 
the payment amount in accordance with the infor- 
mation recorded on the information storage medium 
in the recording step. 

91. A program storage medium including a processing 
program, stored thereon, for controlling a reproduc- 
ing apparatus, to which encrypted data is transmit- 
ted from a predetermined server apparatus and to 
which an information storage medium including a 
key stored thereon for use in decrypting the encrypt- 
ed data is sent, so as to perform a process compris- 
ing 

a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 
apparatus; 

a reading step for reading the key stored on the 
information storage medium; 
a decrypting sLep for decrypting the encrypted 
data received in the receiving step, using the 
key read in the reading step; 
a reproducing step for reproducing the data de- 
crypted in the decrypting step; and 
a control step for controlling the reproduction of 
the data performed in the reproducing step in 
accordance with information stored on the in- 
formation storage medium. 

92. A program storage medium according to Claim 91 , 
wherein 
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the recording step records an allowed repro- 
duction period during which data correspond- 
ing to the key stored on the information storage 
medium is allowed to be reproduced; and 
the control step enables or disables. the repro- 
duction of the data in the reproducing step, in 
accordance with the allowed reproduction peri- 
od recorded on the information storage means. 

93. A program storage medium according to Claim 91 , 
wherein the process further comprises: 

a settling step for performing settlement corre- 
sponding to data reproduced in the reproducing 
step; and 

a settlement information recording step for re- 
cording settlement information on the informa- 
tion storage medium in response to the settle- 
ment. 

94. A program storage medium according to Claim 91, 
wherein the process further comprises: 

a storing step for storing the received encrypted 
data into storage means; and 
a delete flag recording step for, when the en- 
crypted data stored in the storage means is de- 
leted, recording a delete flag on the information 
storage medium. 

95. A program storage medium according to Claim 91, 
wherein the process further comprises: 

a number-of-times value, indicating the number 
of times data corresponding to the key stored 
on the information storage medium is allowed 
to be reproduced, is stored on the information 
storage medium; and 

the control step enables or disables the repro- 
duction of the data in the reproducing step, in 
accordance with the number-of-times value re- 
corded on the information storage medium. 

96. A program storage medium according to Claim 95, 
wherein 

data received in the receiving step includes an 
electronic watermark embedded in the data, 
the watermark indicating that the data is per- 
mitted to be reproduced; and 
the control step reduces the number-of-times 
value each time the reproducing step reproduc- 
es the data, and the control step rewrites the 
electronic watermark embedded in the data so 
as to indicate inhibition of reproduction when 
the number-of-times value becomes equal to 
zero. 
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97. A program storage medium according to Claim 91 , 
wherein the process further comprises: 

a transfer step in which the encrypted data re- 
ceived in the receiving step may be transferred 
by transfer means to another electronic appa- 
ratus; 

a detecting step for detecting transferring, in 
the transfer step, of the encrypted data re- 
ceived in the receiving step to another electron- 
ic apparatus; and 

an ID recording step for, when the detecting 
step detects transferring of the encrypted data, 
recording an ID corresponding to the transfer, 
means on the information storage medium. 

98. A program storage medium according to Claim 91 , 
wherein the process further comprises: 

a mounting step for mounting the information 
storage medium into a mounting part; 
a memorizing step for storing, into memory 
means, information recorded on the informa- 
tion storage medium when the information stor- 
age medium is mounted in the mounting part; 
and 

a rewriting step for rewriting the information re- 
corded on the information storage medium, 

wherein the control step controls the repro- 
duction of the data performed in the reproducing 
step in accordance with the information stored i n the 
memory means. 

99. A program storage medium according to Claim 92, 
wherein the process further comprises a rewriting 
step in which the allowed reproduction period, dur- 
ing which the data corresponding to the key stored 
on the information storage medium is allowed to be 
reproduced, may be rewritten so as to extend the 
allowed reproduction period. 

100. A program storage medium according to Claim 95, 
wherein the process further comprises a settling 
step for performing settlement in accordance with 
the number-of-times value recorded on the informa- 
tion storage medium, the number-of-times value in- 
dicating the number of times the data is allowed to 
be reproduced. 

101 .A program storage medium according to Claim 91 , 
wherein the process further comprises: 

a counting step for counting the number of 
times the data is reproduced in the reproducing 
step; and 

a settlement step for performing settlement in 
accordance with a count value counted in the 
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counting step. 

102. A program storage medium according to Claim 91 , 
wherein the process further comprises a payment 
amount recording step for recording payment 
amount information on the information storage me- 
dium in response to paying a fee. 

103. A control signal for controlling a server apparatus 
to perform a process of delivering data from the 
server apparatus to a reproducing apparatus, the 
process comprising: 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
a transmitting step for transmitting the encrypt- 
ed data to the reproducing apparatus; 
a recording step for recording, on an informa- 
tion storage medium, a key used to decrypt the 
encrypted data; and 

a judgment step for detecting unauthorized use 
of the data transmitted in the transmitting step, 
on the basis of information stored on the infor- 
mation storage medium returned from the re- 
production apparatus. 

1 04. A control signal according to Claim 1 03, wherein the 
recording step records an allowed reproduction pe- 
riod during which data corresponding to the key 
stored on the information storage medium is al- 
lowed to be reproduced. 

105. A control signal accordingto Claim 1 04, wherein the 
judgment step detects unauthorized use of the data, 
on the basis of the allowed reproduction period re- 
corded on the information storage medium. 

1 06. A control signal accordingto Claim 1 03, wherein the 
judgment step detects unauthorized use of the data, 
on the basis of the settlement information recorded 
on the information storage medium by the reproduc- 
ing apparatus. 

1 07. A control signal accordingto Claim 1 03, wherein the 
judgment step detects unauthorized use of the data 
by judging whether a delete flag, which indicates 
that the data transmitted in the transmitting step has 
been deleted, is recorded on an information storage 
medium returned from the reproducing apparatus. 

108. A control signal accordingto Claim 1 03, wherein the 
recording step records a number-of -times value in- 
dicating the number of times data corresponding to 
the key stored on the information storage medium 
is allowed to be reproduced. 

109. A control signal accordingto Claim 1 03, wherein the 
process further comprises an embedding step for 



138 

embedding an electronic watermark indicating the 
allowance of reproduction into the data. 

1 1 0.A control signal according to Claim 1 03, wherein the 
5 judgment step detects unauthorized use of the data 
by judging whether information indicating that the 
data transmitted in the transmitting step has been 
transferred is recorded on an information storage 
medium returned from the reproducing apparatus. 

10 

111 -A control signal according to Claim 1 04, wherein the 
process further comprises a rewriting step in which 
the allowed reproduction period, during which the 
data corresponding to the key stored on the storage 
medium is allowedto be reproduced, may be rewrit- 
ten so as to extend the allowed reproduction period. 

1 1 2. A control signal according to Claim 1 03, wherein the 
process further comprises an updating step for up- 
dating the information recorded on the storage me- 
dium if the judgment step determines, from the in- 
formation recorded on the storage medium, that the 
use of the data is valid. 

113. A control signal according to Claim 112, wherein 

the recording step records, on the information 
storage medium, an identifier of the data, an al- 
lowed reproduction period assigned to the data, 
and a key used to decrypt the data; and 
the updating step updates the information re- 
corded on the information storage medium, if 
the judgment step determines, from the infor- 
mation recorded on the information storage 
medium, that the use of the data is valid. 

1 1 4. A control signal according to Claim 1 03, wherein the 
process further comprises a payment amount up- 
dating step for, when payment amount information 
is recorded on the information storage medium in 
response to payment of a fee performed by the re- 
producing apparatus, updating the payment 
amount information recorded on the information 
storage medium in such a manner as to reduce the 
payment amount in accordance with the information 
recorded on the information storage medium in the 
recording step. 

115. A control signal for controlling a reproducing appa- 
ratus, to which encrypted data is transmitted from a 
predetermined server apparatus and to which an in- 
formation storage medium including a key stored 
thereon for use in decrypting the encrypted data is 
sent, so as to perform a process comprising: 

a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 
apparatus; 
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a reading step for reading the key stored on the 
information storage medium; 
a decrypting step for decrypting the encrypted 
data received in the receiving step, using the 
key read in the reading step; 
a reproducing step for reproducing the data de- 
crypted in the decrypting step; and 
a control step for controlling the reproduction of 
the data performed in the reproducing step in 
accordance with information stored on the in- 
formation storage medium. 

116. A control signal according to Claim 11 5 ; wherein 

the recording step records an allowed repro- 
duction period during which data correspond- 
ing to the key stored on the information storage 
medium is allowed to be reproduced; and 
the control step enables or disables the repro- 
duction of the data in the reproducing step, in 
accordance with the allowed reproduction peri- 
od recorded on the information storage means. 

1 17. A control signal according to Claim 115, wherein the 
process further comprises: 

a settling step for performing settlement corre- 
sponding to data reproduced in the reproducing 
step; and 

a settlement information recording step for re- 
cording settlement information on the informa- 
tion storage medium in response to the settle- 
ment. 

1 18. A control signal according to Claim 115, wherein the 
process further comprises: 

a storing step for storing the received encrypted 
data into storage means; and 
a delete flag recording step for, when the en- 
crypted data stored in the storage means is de- 
leted, recording a delete flag on the information 
storage medium. 

1 19. A control signal according to Claim 1 1 5, wherein the 
process further comprises: 

a number-of-times value, indicating the number 
of times data corresponding to the key stored 
on the information storage medium is allowed 
to be reproduced, is stored on the information 
storage medium; and 

the control step enables or disables the repro- 
duction of the data in the reproducing step, in 
accordance with the number-of-times value re- 
corded on the information storage medium. 

120. A control signal according to Claim 119, wherein 



data received in the receiving step includes an 
electronic watermark embedded in the data, 
the watermark indicating that the data is per- 
mitted to be reproduced: and 

5 the control step reduces the number-of-times 

value each time the reproducing step reproduc- 
. es the data, and the control step rewrites the 
electronic watermark embedded in the data so 
as to indicate inhibition of reproduction when 

10 the number-of-times value becomes equal to 

zero. 

1 21 .A control signal according to Claim 115, wherein the 
process further comprises: 

15 

a transfer step in which the encrypted data re- 
ceived in the receiving step may be transferred 
by transfer means to another electronic appa- 
ratus; 

20 a detecting step for detecting transferring, in 

the transfer step, of the encrypted data re- 
ceived in the receiving step to another electron- 
ic apparatus; and 

an ID recording step for, when the detecting 
25 step detects transferring of the encrypted data, 

recording an ID corresponding to the transfer 
means on the information storage medium. 

1 22. A control signal according to Claim 115, wherein the 
30 process further comprises: 

a mounting step for mounting the information 
storage medium into a mounting part; 
a memorizing step for storing, into memory 
35 means, information recorded on the informa- 

tion storage medium when the information stor- 
age medium is mounted in the mounting part; 
and 

a rewriting step for rewriting the information re- 
40 corded on the information storage medium, 

wherein the control step controls the repro- 
duction of the data performed in the reproducing 
step in accordance with the information stored in the 
45 memory means. 

1 23. A control signal according to Claim 1 1 6, wherein the 
process further comprises a rewriting step in which 
the allowed reproduction period, during which the 

so data corresponding to the key stored on the infor- 

mation storage medium is allowed to be repro- 
duced, may be rewritten so as to extend the allowed 
reproduction period. 

55 1 24 .A control signal according to Claim 119, wherein the 
process further comprises a settling step for per- 
forming settlement in accordance with the number- 
of-times value recorded on the information storage 
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medium, the number-of-times value indicating the 
number of times the data is allowed to be repro- 
duced. 

1 25. A control signal according to Claim 115, wherein the 5 
process further comprises: 

a counting step for counting the number of 
times the data is reproduced in the reproducing 
step; and w 
a settlement step for performing settlement in 
accordance with a count value counted in the 
counting step. 

126. A control signal according to Claim 115, wherein the is 
process further comprises a payment amount re- 
cording step for recording payment amount infor- 
mation on the information storage medium in re- 
sponse to paying a fee. 

20 

127. A data delivery method comprising: 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
a transmitting step for transmitting the encrypt- 25 
ed data; 

a recording step for recording, on a storage me- 
dium, a key used to decrypt the encrypted data; 
a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 30 
apparatus; 

a reading step for reading the key stored on the 
storage medium; 

a decrypting step for decrypting the encrypted 
data received in the receiving step, using the 35 
key read in the reading step; 
a controlling step for enabling or disabling re- 
production of the data decrypted in the decrypt- 
ing step, in accordance with the information re- 
corded on the storage medium; 40 
a reproducing step for reproducing the decrypt- 
ed data, in accordance with the control in the 
controlling step; and 

a judging step for detecting unauthorized use 

of the data, on the basis of information stored 45 

on the storage medium. 

128. A method of delivering data to a reproducing appa- 
ratus, comprising: 

50 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
a transmitting step for transmitting the encrypt- 
ed data; 

a recording step for recording, on a storage me- 55 
dium, a key used to decrypt the encrypted data; 
and 

a judging step for detecting unauthorized use 



of the data, on the basis of information stored 
on a storage medium returned from the repro- 
ducing apparatus. 

129. A method of reproducing data by a reproducing ap- 
paratus to which encrypted data is transmitted from 
a predetermined server apparatus and to which a 
storage medium including a key stored thereon for 
use in decrypting the encrypted data is sent the 
method comprising: 

a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 
apparatus; 

a reading step for reading the key stored on the 
storage medium; 

a decrypting step for decrypting the encrypted 
• data received in the receiving step, using the 
key read in the reading step; 
a controlling step for enabling or disabling re- 
production of the data decrypted in the decrypt- 
ing step, in accordance with the information re- 
corded on the storage medium; and 
a reproducing step for reproducing the decrypt- 
ed data, in accordance with the control in the 
controlling step. 

130 . A storage medium including a processing program, 
stored thereon, for controlling a server apparatus to 
execute a data delivery process for delivering data 
to a reproducing apparatus, the processing pro- 
gram comprising: 

an encrypting step for encrypting data and out- 
putting the resultant encrypted data; 
a transmitting step for transmitting the encrypt- 
ed data; 

a recording step for recording, on a storage me- 
dium, a key used to decrypt the encrypted data; 
and 

a judging step for detecting unauthorized use 
of the data, on the basis of information stored 
on a storage medium returned from the repro- 
ducing apparatus. 

131 .A program storage medium including a processing 
program, stored thereon, for controlling a reproduc- 
ing apparatus to which encrypted data is transmit- 
ted from a predetermined server apparatus and to 
which an information storage medium including a 
key stored thereon for use in decrypting the encrypt- 
ed data is sent, the processing program serving to 
control the reproducing apparatus to perform a 
process of reproducing the data, the process com- 
prising: 

a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 
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apparatus; 

a reading step for reading the key stored on the 
information storage medium; 
a decrypting step for decrypting the encrypted 
data received in the receiving step, using the 5 
key read in the reading step; 
a controlling step for enabling or disabling re- 
production of the data decrypted in the decrypt- 
ing step, in accordance with the information re- 
corded on the information storage medium; and 10 
a reproducing step for reproducing the decrypt- 
ed data, in accordance with the control in the 
controlling step. 

132. A storage medium which is delivered between a *5 
server apparatus and a reproducing apparatus in a 
data delivery system for delivering encrypted data 
from the server apparatus to the reproducing appa- 
ratus, wherein at least information indicating an 
identifier of the data, a key used to decrypt the data, 20 
and a reproduction condition of the data is stored 

on the storage medium. 

1 33. A storage medium according to Claim 1 32, wherein 

tno information indicating the reproduction condi- 25 
t'on is information indicating a period during which 
tnc data is allowed to be reproduced. 

134. A storage medium according to Claim 132, wherein 

tic information indicating the reproduction condi- 30 
t on is information indicating the number of times the 
cat* is allowed to be reproduced. 

135. A storage medium according to Claim 1 32, wherein 
settlement information is stored on the storage me- 35 
ciun tn response to settlement associated with the 
oata reproduced by the reproducing apparatus. 

136. A storage medium according to Claim 1 32, wherein 

a delete flag is stored on the storage medium in re- 40 
sponse to deleting data from the reproducing appa- 
ratus 

137. A storage medium according to Claim 1 32, wherein 
information indicating that the data is transferred or 45 
output from the reproducing apparatus is stored on 

the storage medium. 

138. A storage medium according to Claim 1 32, wherein 
payment amount information is stored on the stor- so 
age medium in response to payment of a fee per- 
formed by the reproducing apparatus. 

139. A control signal for controlling a server 'apparatus 

to perform a process of delivering data to a repro- 55 
ducing apparatus, the process comprising 

an encrypting step for encrypting data and out- 
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putting the resultant encrypted data: 
a transmitting step for transmitting the encrypt- 
ed data; 

a recording step for recording, on a storage me- 
dium, a key used to decrypt the encrypted data; 
and 

a judging step for detecting unauthorized use 
of the data, on the basis of information stored 
on a storage medium returned from the repro- 
ducing apparatus. 

140 .A control signal for controlling a reproducing appa- 
ratus to which encrypted data is transmitted from a 
predetermined server apparatus and to which a 
storage medium including a key stored thereon for 
use in decrypting the encrypted data is sent, the 
control signal serving to control the reproducing ap- 
paratus to perform a process of reproducing the da- 
ta, the process comprising: 

a receiving step for receiving the encrypted da- 
ta transmitted from the predetermined server 
apparatus; 

a reading step for reading the key stored on the 
storage medium; 

a decrypting step for decrypting the encrypted 
data received in the receiving step, using the 
key read in the reading step; 
a controlling step for enabling or disabling re- 
production of the data decrypted in the decrypt- 
ing step, in accordance with the information re- 
corded on the storage medium; and 
a reproducing step for reproducing the decrypt- 
ed data : in accordance with the control in the 
controlling step. 

1 41 .A transmission data signal which is transmitted be- 
tween a server apparatus and a reproducing appa- 
ratus in a data delivery system for delivering en- 
crypted data from the server apparatus to the repro- 
ducing apparatus, wherein the transmission data 
signal includes at least information indicating an 
identifier of the data, a key used to decrypt the data, 
and a reproduction condition of the data. 

142. A transmission data signal according to Claim 141 , 
wherein the information indicating the reproduction 
condition includes information indicating a period 
during which the data is allowed to be reproduced. 

143. A transmission data signal according to Claim 141 , 
wherein the information indicating the reproduction 
condition includes information indicating the 
number of times the data is allowed to be repro- 
duced. 

144 . A transmission data signal according to Claim 141 , 
wherein the information includes settlement infor- 
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mation created in response to settlement associat- 
ed with the data reproduced by the reproducing ap- 
paratus. 

145. A transmission data signal according to Claim 141, 5 
wherein the information includes a delete flag cre- 
ated in response to deleting the data from the re- 
producing apparatus. 

146. A transmission data signal according to Claim 141, 10 
wherein the information includes information gen- 
erated in response to outputting or transferring the 
data from the reproducing apparatus, so as to indi- 
cate that the data has been output or transferred. 



147. A transmission data signal according to Claim 141, 
wherein the information includes payment amount 
information created in response to payment of a fee 
performed by the reproducing apparatus. 
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